on Thu, May 30, 2002, Xaveer Leijtens (X.Leijtens@its.tudelft.nl) wrote:
> A number of my files have become invisible to 'ls'. For example
> /var/log/apache seems empty, but I can still cat/edit/... the files
> which I know are there, for example:
>
> [iopo] cd /var/log/apache
> [iopo] ls -la
> total 9
> drwxr-xr-x 2 root root 5120 May 1 06:25 .
> drwxrwsr-x 10 root adm 4096 May 30 09:40 ..
> [iopo] head -2 access.log
> alfredo.wise-guys.nl - - [01/May/2002:06:25:51 +0200] "GET
> /people/francisco.html HTTP/1.0" 200 4614
> iopo.et.tudelft.nl - - [01/May/2002:06:28:16 +0200] "GET /robots.txt
> HTTP/1.0" 404 204
> [iopo] head -2 referer.log
> alfredo.wise-guys.nl - -> /people/francisco.html
> iopo.et.tudelft.nl - -> /robots.txt
What is the output of "echo * .?*". This should list out all files in
the current directory on one line.
It appears that you have execute privs on the directory, which matters.
> The files that have disappeared (that I found so far) are in
> /var/log/apache, and some of my web pages in /var/www. The web pages are
> still being served, and logged, however.
> This disk is also NFS exported, and also from another machine through
> NFS I see the same thing happening. I did an fsck on this disk and
> rebooted, but no change. I run a custom 2.2.15 kernel with debian
> potato. I tried a different 'ls' executable, with the same result.
What's the filesystem -- ext2fs?
> Has this machine been cracked?
Possibly. 'ls' is a popular target.
> Is the disk broken?
Also possible. You might want to try copying / archiving the files
elsewhere to see what you find.
> What can I do?
Boot known good media (I recommend LNX-BBC, http://www.lnx.bbc.org/) and
see if you can list the directory. Check your 'ls' binary while you're
at it, see if it looks legit, check it against the md5 hash
in /var/lib/dpkg/info/fileutils.md5sums.
Peace.
--
Karsten M. Self <kmself@ix.netcom.com> http://kmself.home.netcom.com/
What Part of "Gestalt" don't you understand?
Scandinavian Designs: Cool furniture, affordable prices, great service.
San Rafael, CA.
Attachment:
pgp4i485znBkA.pgp
Description: PGP signature