Mikkel, his example shows that he already did chattr -i the file.
lemon: Make sure that there are no running ftp sessions...it's possible
that the file can't be removed because it's in use.
On Thu, 8 Mar 2001, Mikkel L. Ellertson wrote:
> On Thu, 8 Mar 2001 [EMAIL PROTECTED] wrote:
>
> > my redhat server was hijacked and the shell commands attributes
> > were changed,for instances:i loged in as root and do:
> >
> > #lsattr /usr/bin/ftp
> > ----i--- /usr/bin/ftp
> > #chattr -i /usr/bin/ftp
> > -------- /usr/bin/ftp
> >
> > but i still can not delete the shell command,error like this:"rm:
> > cannot unlink `ftp': Permission denied
> >
> >
> As a temperary fix, you can use the chattr to remove the `i' attribute.
> (man chattr)
>
> But to be safe, you realy need to back up your data, wipe the disk, and
> re-install the OS. The install the updates BEFORE putting the server
> back online. Anything else is inviting trouble. You have no idea what
> kind of back doors were installed on your system.
>
> Mikkel
> --
>
> Do not meddle in the affairs of dragons,
> for you are crunchy and taste good with ketchup.
>
>
>
> _______________________________________________
> Redhat-list mailing list
> [EMAIL PROTECTED]
> https://listman.redhat.com/mailman/listinfo/redhat-list
>
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
