Re: My Linux server got hacked last night -- please help!

From: Bill Unruh (unruh_at_string.physics.ubc.ca)
Date: 11/29/04 

Date: 29 Nov 2004 20:43:26 GMT

Sundial Services <info@sundialservices.com> writes:

]sarah chang wrote:
]> It looks as though my Linux server (running RedHat Fedora Core 3) was
]> hacked last night.
]> [...]
]> I can't chmod or chown these files, even as root.

]The first thing I would do, after taking the system off any network, is to
]thoroughly check for filesystem damage, e.g. with "shutdown -rF", the "F"
]option forcing an fsck upon reboot.

]If you are unable to use chmod or chown against the files, when you have
]restarted with the rescue-CD (and you know that you are in fact executing
]the commands from that immutable CD), then this strongly implies to me a
]filesystem failure, rather than a "hack."

Could be but first do lsattr filename and see if the i bit is set
man lsattr
man chattr

Then do
rpm -Vf /complete/name/of/file/with/path

Relevant Pages

  • coreutils-5.94 released [stable]
    ... [basename cat chgrp chmod chown chroot cksum comm cp csplit cut date dd ... If that command fails because you don't have the required public key, ...
    (gnu.announce)
  • Re: [Full-Disclosure] Partial Solution to SUID Problems
    ... > that to chown or chmod the pty they just allocated. ... world-writable ttyXX. ... appropriately when you open ptyXX (which can be done only once, ...
    (Full-Disclosure)
  • root cannot chmod or chown a directory
    ... Am trying to chmod or chown a directory but am getting a chown: RPA: Not ... I'm supposed to be a superuser and I can't do this simple thing as root. ...
    (SunManagers)
  • Re: Security related questions
    ... could anyone explain some examples of setting up a restricted group for ... using chmod and chown.. ... Possable set up a special group for him. ...
    (freebsd-stable)
  • chmod, chown and user, group
    ... When chmod, chown sys calls fail the set an errno, how can I retrieve ... How can I retrieve uid, gid of the current user via sys call? ...
    (comp.os.linux.development.apps)