[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Regular files/directories invisible

on Thu, May 30, 2002, Xaveer Leijtens (X.Leijtens@its.tudelft.nl) wrote:
> A number of my files have become invisible to 'ls'. For example
> /var/log/apache seems empty, but I can still cat/edit/... the files
> which I know are there, for example:
>   [iopo] cd /var/log/apache
>   [iopo] ls -la
>   total 9
>   drwxr-xr-x    2 root     root         5120 May  1 06:25 .
>   drwxrwsr-x   10 root     adm          4096 May 30 09:40 ..
>   [iopo] head -2 access.log
>   alfredo.wise-guys.nl - - [01/May/2002:06:25:51 +0200] "GET
>   /people/francisco.html HTTP/1.0" 200 4614
>   iopo.et.tudelft.nl - - [01/May/2002:06:28:16 +0200] "GET /robots.txt
>   HTTP/1.0" 404 204
>   [iopo] head -2 referer.log
>   alfredo.wise-guys.nl - -> /people/francisco.html
>   iopo.et.tudelft.nl - -> /robots.txt

What is the output of "echo * .?*".  This should list out all files in
the current directory on one line.

It appears that you have execute privs on the directory, which matters.

> The files that have disappeared (that I found so far) are in
> /var/log/apache, and some of my web pages in /var/www. The web pages are
> still being served, and logged, however.
> This disk is also NFS exported, and also from another machine through
> NFS I see the same thing happening. I did an fsck on this disk and
> rebooted, but no change. I run a custom 2.2.15 kernel with debian
> potato. I tried a different 'ls' executable, with the same result.

What's the filesystem -- ext2fs?

> Has this machine been cracked? 

Possibly.  'ls' is a popular target.

> Is the disk broken? 

Also possible.  You might want to try copying / archiving the files
elsewhere to see what you find.

> What can I do?

Boot known good media (I recommend LNX-BBC, http://www.lnx.bbc.org/) and
see if you can list the directory.  Check your 'ls' binary while you're
at it, see if it looks legit, check it against the md5 hash
in /var/lib/dpkg/info/fileutils.md5sums.


Karsten M. Self <kmself@ix.netcom.com>        http://kmself.home.netcom.com/
 What Part of "Gestalt" don't you understand?
   Scandinavian Designs:  Cool furniture, affordable prices, great service.
     San Rafael, CA.

Attachment: pgpTYiL7kCpqC.pgp
Description: PGP signature

Reply to: