Joell Chockley wrote:
I've got a strange problem with a Linux guest. The only indicator we've come up with so far is that /dev/null had it's file permissions changed on Friday afternoon to -rw-r--r-- 1 root root 81 2008-01-11 15:03 /dev/null (we don't know how this was changed). One of our admins changed it back to
This is what I would expect to see if someone deleted /dev/null and then root did something like echo >/dev/null as you would expect root to do sometimes - just look at /etc/init.d/* grep /dev/null /etc/init.d/* _I_ would like to know who|what deleted /dev/null and what else was done, it sounds to me like a breakdown in procedures, or some malware was installed. -- Cheers John -- spambait [EMAIL PROTECTED] [EMAIL PROTECTED] -- Advice http://webfoot.com/advice/email.top.php http://www.catb.org/~esr/faqs/smart-questions.html http://support.microsoft.com/kb/555375 You cannot reply off-list:-) ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
