Re: Can't remove file as root

From: Bill Unruh (unruh@physics.ubc.ca)
Date: 02/24/02 

From: unruh@physics.ubc.ca (Bill Unruh)
Date: 24 Feb 2002 01:10:44 GMT

In <3c782572_4@corp-news.newsgroups.com> "ynotssor" <ynotssorAT hotmail dot `\rm -rf /` com> writes:

]"Bob Lawson" <blawson@parkridge.on.ca> wrote in message
]news:3c77b11a.358357950@news.cogeco.ca...
][...]
]>>I have the problem, that I can't remove a file as root anymore, and I
]>>don't know why. The file was replaced by a hacker.
]>>
]>>root@host:/bin # ls -l ps
]>>-rwxr-xr-x 1 root root 13583 Feb 9 01:04 ps
]>>root@host:/bin # rm ps
]>>rm: remove `ps', overriding mode 0755? y
]>>rm: ps: Operation not permitted
]>>root@host:/bin # chmod 0700 ps
]>>chmod: ps: Operation not permitted
][...]
]>

man lsattr
man chattr

]> To be totally sure you must reinstall/recover from backups.

]NO!!. Reformat and re-install the OS from distribution media. DO NOT enable the
]services that allowed for the initial compromise until they are replaced with
]secure versions. Backups may only be used for non-sytem data recovery, and then
]only after careful consideration of the possibilities.

Not terribly helpful .
Backups could be used for system as well, as long as you make sure that
the backup itself is not broken.
on a rpm system, so
rpm -Va|grep '^..5'>/tmp/verify
and look at the files there Some are config files, which should have
been changed, If some are system files, then reinstall.

After reinstall make sue you instal all of the security patches. Then
also do
find / -perm +6000 -ls
to find all of the suid root files. some should be (rpm -Va -f
name/of/file) but some may have been planted by the attacker.
Also change each and every password.

]There is no fix, just re-installation of the entire OS.

]The "rm" may be a trojan as well as "login", "passwd" and any other
]commonly-used system commands.

]Any or all of them may have been replaced by the rootkit.

Relevant Pages

  • Re: Please help,,,execute chmod –R o-r / by mistake as a root user.
    ... automatically restore permission bits. ... RPM has the ability to check file permission bits relative ... You may be able to use your backups to fix the permission ...
    (linux.redhat.install)
  • RE: i just did a rm -rf /*r as root!!!
    ... i have no backups, the system hadn't gotten to the point where i was ready ... Since you've got a valid rpm database, you'll need to do the rpm -Va to ... apparently don't have restorable backups. ... To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list ...
    (Fedora)
  • Re: Rebuilding my server
    ... I remember back then an upgrade to the hard ... rpm or some such speed (three phase motors). ... We did that routinely for backups, although we also did backups on a ...
    (comp.os.linux.setup)