xfn directory

xfn directory

Post by Alla » Fri, 20 Jun 2003 07:44:38



Hi All,
I can not access any files in xfn directory.  This could be the result
of attempt by hackers to install RootToolkit on my system.  Any ideas
how to get around it?
Thanks in advance for any suggestions

 
 
 

xfn directory

Post by all mail refus » Fri, 20 Jun 2003 18:36:58



>I can not access any files in xfn directory.  This could be the result
>of attempt by hackers to install RootToolkit on my system.  Any ideas
>how to get around it?

Is that your only evidence of possible intrusion ?  I wouldn't rush to
assume that's the cause.

You didn't say, but is this Solaris ?

Can you use a ufsdump|ufsrestore pipeline to list the files ?
Example on linux:
    dump 0Bf 1000000 - /var | restore -ivf -
restore > ls
.:
    2 ./           16120 empty/          11 lost+found/  38153 run/
    2 ../             43 ftp/            12 mail         40161 spool/
18107 adm/          4017 lib/         28114 named/       46185 tmp/
20082 arpwatch/    26105 local/       34137 opt/
16065 cache/       28113 lock/        36145 preserve/
20081 db/          12049 log/

Can you fsck all filesystems ?

You might want to remove the disks from this host and add them to another
that you don't suspect of being compromised (fresh install good).  Do this
read-only and without executing anything on them.  Back them up there and
examine the contents on that safe host.  That should help determine what
you've got - rootkit, flaky disk, pinhead driving rm....

--


 
 
 

xfn directory

Post by Bill Marcu » Fri, 20 Jun 2003 20:48:21


On 18 Jun 2003 15:44:38 -0700, Allan


> Hi All,
> I can not access any files in xfn directory.  This could be the result
> of attempt by hackers to install RootToolkit on my system.  Any ideas
> how to get around it?
> Thanks in advance for any suggestions


If you think your system has been hacked, disconnect it from the network.
Are you root when you try to access that directory?  What does "ls -ld xfn"
say?  What error messages do you get?

--
It is often the case that the man who can't tell a lie thinks he is the best
judge of one.
                -- Mark Twain, "Pudd'nhead Wilson's Calendar"

 
 
 

xfn directory

Post by Warner Brigha » Sat, 21 Jun 2003 10:38:11




> Hi All,
> I can not access any files in xfn directory.  This could be the result
> of attempt by hackers to install RootToolkit on my system.  Any ideas
> how to get around it?
> Thanks in advance for any suggestions


I recently had a problem with /xfn.  By default it's in /etc/auto_master
though unused.  I found a core file from autofs with a timestamp of when
the problem started (updatedb was* as "find /" would never complete,
* in /xfs.)  The automounter loads a fair sized tree at /xfn.  Look
at /etc/mnttab and umount them level by level until you can umount /xfn
itself.  Everything then was fine, and I commented it out of
/etc/auto_master.  This was on Solaris 8.  The machine is firewalled,
totally wrappered, and only answers to port 22 (ssh), and then only allows
DSA key logins, so no nefarious activities were involved.  The system did
this all by itself.

/xfn itself seems a total crock.  See "man xfn" and "man fns".
It's the X/Open Federated Naming Service and I have no need for it on
my workstation. YMMV

 
 
 

1. Using XFN for hosts and users

Hi All!

It's possible to use FNS (XFN) as base for resolving hosts or users ?

For example:
In FNS I define record like "user/ivosh" with some attributes
(password, real name etc.)
and whole OS use this record same way like it was written in
/etc/passwd file or NIS+ map.

Some idea maybe in xfn field in nsswitch.conf file ...
... but in Solaris 2.6 I tried and doesn't work.

Thanks for answers

Ivo(sh) Musil

2. kde X startup and shutdown errors

3. Solaris 8 bug: xfn filesystem puts badly formatted entries in /etc/mnttab

4. Q: about versions of the 'mt' program

5. xfn & find & -nobrowse

6. Dot clock (driving clock frequency) for Tseng Lab ET4000?

7. /xfn messed up

8. Mail setup for Additional domain names on same linux box

9. XFN

10. XFN and X500 question

11. xfn problem on 2.6

12. What's in /xfn?

13. How to use /xfn