On Thu, 8 Mar 2001 [EMAIL PROTECTED] wrote:
> my redhat server was hijacked and the shell commands attributes
> were changed,for instances:i loged in as root and do:
>
> #lsattr /usr/bin/ftp
> ----i--- /usr/bin/ftp
> #chattr -i /usr/bin/ftp
> -------- /usr/bin/ftp
>
> but i still can not delete the shell command,error like this:"rm:
> cannot unlink `ftp': Permission denied
>
>
As a temperary fix, you can use the chattr to remove the `i' attribute.
(man chattr)
But to be safe, you realy need to back up your data, wipe the disk, and
re-install the OS. The install the updates BEFORE putting the server
back online. Anything else is inviting trouble. You have no idea what
kind of back doors were installed on your system.
Mikkel
--
Do not meddle in the affairs of dragons,
for you are crunchy and taste good with ketchup.
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
