[ale] /tmp set to read-only on boot (need help)

[Ryan Fish]

I didn't find anything strange in /etc/passwd, /etc/shadow or when running
"crontab -l".  There isn't anything running that appears to be out of place
either.

-Ryan

-----Original Message-----
From: ale-bounces at ale.org [mailto:ale-bounces at ale.org] On Behalf Of Sergio
Chaves
Sent: Friday, June 17, 2005 9:28 AM
To: Atlanta Linux Enthusiasts
Subject: Re: [ale] /tmp set to read-only on boot (need help)

I had a similar problem when my mandrake box was hacked.
Take a look at /etc/passwd and shadow for some strange entry.
Also, check all running processes. Thats how I found out I was being used as
a 
spammer. My system would slow down dramaticaly at random times.

If this is your case, "crontab -l" should list all paths to the crap
installed 
in your server.

Make sure to set all other "users" in /etc/passwd to /bin/false 
or /sbin/nologin.


my 2 cents

Sergio



On Thursday 16 June 2005 12:42 pm, Ryan Fish wrote:
> Yes, it is possible.  However, I do not know how I would be able to tell
if
> that happened as I was not at a console when I rebooted the server.  It
did
> take quite a long time for it to come back online though...
>
> -Ryan
>
> > From: Jim Popovitch <jimpop at yahoo.com>
> > Date: 2005/06/16 Thu PM 12:38:56 EDT
> > To: Atlanta Linux Enthusiasts <ale at ale.org>
> > Subject: Re: [ale] /tmp set to read-only on boot (need help)
> >
> > Is it possible /tmp had a fsck error during boot and was mounted ro
> > temporarily?
> >
> > -Jim P.
> >
> > On Thu, 2005-06-16 at 11:50 -0400, Ryan Fish wrote:
> > > I'm not sure why, but /tmp is set to read-only on a RHEL3 AS server.
I
> > > am trying to set it back to allow writing but am failing so far.
> > >
> > > Here is what I am seeing (I am unable to write to /tmp in any
manner.):
> > >
> > > [root at mcdb02 root]# crontab -e
> > > /tmp/crontab.17515: Read-only file system
> > >
> > >
> > > When trying to force the mounts to setup I see the following:
> > >
> > > [root at mcdb02 root]# mount -a
> > > mount: /dev/sda1 already mounted or /boot busy
> > >
> > > There is no mention of /tmp in /etc/fstab or /etc/mtab
> > >
> > > I can write to other locations on the server.
> > >
> > > Any ideas on what I can try to get this fixed?  I guess a clean reboot
> > > should allow it to function properly again but I am trying to get by
> > > without doing that.
> > >
> > > Thank you.
> > > -Ryan
> > >
> > >
> > > _______________________________________________
> > > Ale mailing list
> > > Ale at ale.org
> > > http://www.ale.org/mailman/listinfo/ale
> >
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://www.ale.org/mailman/listinfo/ale
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale

-- 
The Bible tells us to love our neighbors, and also to love our enemies; 
probably because they are generally the same people.
    G. K. Chesterton
--

Sergio Chaves
Edi and IT Support
Turbo Logistics, Inc.
(Office) 770-532-2239
(Fax)     770-531-7878
sergio at turbocorp.com
www.turbocorp.com


This transmission (including attachments) may be: (1) subject to the
Attorney-Client Privilege, (2) an attorney work product, or (3) strictly
confidential to Turbo Logistics, Inc.  If you are not the intended recipient
of this message (or authorized to receive for the intended recipient), you
may not read, retain, disclose, print, copy or disseminate to anyone this
information. If you have received this in error, please reply and notify the
sender (only) by reply email, and destroy all copies of the message
(including any attachments). Unauthorized interception of this e-mail is a
violation of federal criminal law. 
_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale