Re: rkhunter found this...

2009-03-27 Thread Steven W. Orr
On Thursday, Mar 26th 2009 at 20:30 -, quoth Tom Horsley: =>Doing "whatever > /dev/null" wasn't too bad, but when =>someone said "whatever < /dev/null" amazingly random things =>could happen. Years ago I had a client who ran out of disk. I eventually found out that he was backing up to /dev/

Re: rkhunter found this...

2009-03-27 Thread Aaron Konstam
On Fri, 2009-03-27 at 16:08 +0100, Roberto Ragusa wrote: > Tom Horsley wrote: > > > Could be, but I had /dev/null deleted on a machine once and > > the ensuing fun was really spectacular :-). > > > > Doing "whatever > /dev/null" wasn't too bad, but when > > someone said "whatever < /dev/null" ama

Re: rkhunter found this...

2009-03-27 Thread Mike McCarty
g wrote: Bill Davidsen wrote: Script typo. Try this: find /etc -type file | xargs grep -l '/dev/nul[^l]' should that be " -type f "? A more interesting characteristic is that it requires that there be a character following "/dev/nul". IME redirection is often the last thing on the line M

Re: rkhunter found this...

2009-03-27 Thread Roberto Ragusa
Tom Horsley wrote: > Could be, but I had /dev/null deleted on a machine once and > the ensuing fun was really spectacular :-). > > Doing "whatever > /dev/null" wasn't too bad, but when > someone said "whatever < /dev/null" amazingly random things > could happen. Even funnier stuff happened to me

Re: rkhunter found this...

2009-03-27 Thread Aaron Konstam
On Thu, 2009-03-26 at 23:50 -0400, Joe Smith wrote: > Daniel B. Thurman wrote: > > ... > >> For fun, I looked at: /etc/init.d/nsd and there was code > >> in two places that had: 2>%1 (a stderr redirect?) and I suspected > >> it was intended to be: 2>&1? I was not sure the % was > >> something I h

Re: rkhunter found this...

2009-03-27 Thread Aaron Konstam
On Thu, 2009-03-26 at 19:07 -0700, Daniel B. Thurman wrote: > Daniel B. Thurman wrote: > > Mikkel L. Ellertson wrote: > >> Rick Stevens wrote: > >> > >>> Do NOT ignore it. I don't think you quite understand what /dev/null > >>> is. It is supposed to be a device, not a file. Somehow it got dele

Re: rkhunter found this...

2009-03-27 Thread Aaron Konstam
On Thu, 2009-03-26 at 18:03 -0700, Rick Stevens wrote: > Daniel B. Thurman wrote: > > Tom Horsley wrote: > >> On Thu, 26 Mar 2009 20:07:54 -0400 > >> brian wrote: > >> > >> > It means some script somewhere did an rm -f on /dev/null > then later some other script redirected output to /de

Re: rkhunter found this... [SOLVED: Bug report filed]

2009-03-27 Thread Daniel B. Thurman
Daniel B. Thurman wrote: From: rkhunter: Warning: Suspicious file types found in /dev: /dev/nul: ASCII text Looking @ /dev/nul: = # more /dev/nul nsdc: no patch necessary. = What d

Re: rkhunter found this...

2009-03-27 Thread M A Young
On Thu, 26 Mar 2009, Daniel B. Thurman wrote: The "clue" I left was: ===[/dev/nul]= # more /dev/nul nsdc: no patch necessary. For fun, I looked at: /etc/init.d/nsd and there was code in two places that had: 2>%1 (a stderr redirect?) and

Re: rkhunter found this...

2009-03-26 Thread Joe Smith
Daniel B. Thurman wrote: ... For fun, I looked at: /etc/init.d/nsd and there was code in two places that had: 2>%1 (a stderr redirect?) and I suspected it was intended to be: 2>&1? I was not sure the % was something I have seen before - this does not exists in the entire /etc/init.d directory

Re: rkhunter found this...

2009-03-26 Thread g
Bill Davidsen wrote: > Script typo. Try this: > find /etc -type file | xargs grep -l '/dev/nul[^l]' should that be " -type f "? -- peace out. tc,hago. g . in a free world without fences, who needs gates. ** help microsoft stamp out piracy - give linux to a friend today ** to mess up

Re: rkhunter found this...

2009-03-26 Thread Bill Davidsen
Daniel B. Thurman wrote: From: rkhunter: Warning: Suspicious file types found in /dev: /dev/nul: ASCII text Looking @ /dev/nul: = # more /dev/nul nsdc: no patch necessary. = What d

Re: rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
Daniel B. Thurman wrote: Daniel B. Thurman wrote: Mikkel L. Ellertson wrote: Rick Stevens wrote: Do NOT ignore it. I don't think you quite understand what /dev/null is. It is supposed to be a device, not a file. Somehow it got deleted and now whenever a script or something does a redirec

Re: rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
Daniel B. Thurman wrote: Mikkel L. Ellertson wrote: Rick Stevens wrote: Do NOT ignore it. I don't think you quite understand what /dev/null is. It is supposed to be a device, not a file. Somehow it got deleted and now whenever a script or something does a redirect of its output to /dev/nul

Re: rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
Mikkel L. Ellertson wrote: Rick Stevens wrote: Do NOT ignore it. I don't think you quite understand what /dev/null is. It is supposed to be a device, not a file. Somehow it got deleted and now whenever a script or something does a redirect of its output to /dev/null, instead of going to a

Re: rkhunter found this...

2009-03-26 Thread Mikkel L. Ellertson
Rick Stevens wrote: > > Do NOT ignore it. I don't think you quite understand what /dev/null > is. It is supposed to be a device, not a file. Somehow it got deleted > and now whenever a script or something does a redirect of its output to > /dev/null, instead of going to a device (and thence int

Re: rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
Daniel B. Thurman wrote: Daniel B. Thurman wrote: Tom Horsley wrote: On Thu, 26 Mar 2009 20:07:54 -0400 brian wrote: It means some script somewhere did an rm -f on /dev/null then later some other script redirected output to /dev/null thus creating it as a regular file. It looks more like a t

Re: rkhunter found this...

2009-03-26 Thread Dave Ihnat
On Thu, Mar 26, 2009 at 08:13:41PM -0400, Tom Horsley wrote: > On Thu, 26 Mar 2009 14:40:06 -0700 > Daniel B. Thurman wrote: > > > Looking @ /dev/nul: > > = > > # more /dev/nul > > nsdc: no patch necessary. > > = > > > > What does this mean? > > It means s

Re: rkhunter found this...

2009-03-26 Thread Rick Stevens
Daniel B. Thurman wrote: Tom Horsley wrote: On Thu, 26 Mar 2009 20:07:54 -0400 brian wrote: It means some script somewhere did an rm -f on /dev/null then later some other script redirected output to /dev/null thus creating it as a regular file. It looks more like a typo, as another

Re: rkhunter found this...

2009-03-26 Thread Kevin J. Cummings
Daniel B. Thurman wrote: Tom Horsley wrote: On Thu, 26 Mar 2009 20:07:54 -0400 brian wrote: It means some script somewhere did an rm -f on /dev/null then later some other script redirected output to /dev/null thus creating it as a regular file. It looks more like a typo, as another

Re: rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
Daniel B. Thurman wrote: Tom Horsley wrote: On Thu, 26 Mar 2009 20:07:54 -0400 brian wrote: It means some script somewhere did an rm -f on /dev/null then later some other script redirected output to /dev/null thus creating it as a regular file. It looks more like a typo, as another poster sai

Re: rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
Tom Horsley wrote: On Thu, 26 Mar 2009 20:07:54 -0400 brian wrote: It means some script somewhere did an rm -f on /dev/null then later some other script redirected output to /dev/null thus creating it as a regular file. It looks more like a typo, as another poster said (one L).

Re: rkhunter found this...

2009-03-26 Thread Tom Horsley
On Thu, 26 Mar 2009 20:07:54 -0400 brian wrote: > > It means some script somewhere did an rm -f on /dev/null > > then later some other script redirected output to /dev/null > > thus creating it as a regular file. > > > It looks more like a typo, as another poster said (one L). Could be, but I

Re: rkhunter found this...

2009-03-26 Thread brian
Tom Horsley wrote: On Thu, 26 Mar 2009 14:40:06 -0700 Daniel B. Thurman wrote: Looking @ /dev/nul: = # more /dev/nul nsdc: no patch necessary. = What does this mean? It means some script somewhere did an rm -f on /dev/null then later some other script

Re: rkhunter found this...

2009-03-26 Thread Tom Horsley
On Thu, 26 Mar 2009 14:40:06 -0700 Daniel B. Thurman wrote: > Looking @ /dev/nul: > = > # more /dev/nul > nsdc: no patch necessary. > = > > What does this mean? It means some script somewhere did an rm -f on /dev/null then later some other script redirecte

Re: rkhunter found this...

2009-03-26 Thread Kevin J. Cummings
Daniel B. Thurman wrote: From: rkhunter: Warning: Suspicious file types found in /dev: /dev/nul: ASCII text Looking @ /dev/nul: = # more /dev/nul nsdc: no patch necessary. = What d

rkhunter found this...

2009-03-26 Thread Daniel B. Thurman
From: rkhunter: Warning: Suspicious file types found in /dev: /dev/nul: ASCII text Looking @ /dev/nul: = # more /dev/nul nsdc: no patch necessary. = What does this mean? Thanks! Da