My VPS sometimes goes wild because of     /tmp/.X17-unix/.rsync/c/lib/64/tsm --library-path   /tmp/.X17-unix/.rsync/c/lib/64/ /tmp/.X17-unix/.rsync/c/tsm64 -t 302   -f 1 -s 8 -S 8 -p 0 -d 1   Any idea what it is and what does it do? And more important, how can I make sure it dosn't kill my VPS? Thanks  edit: after killing the pid and restarting the VPS, I'm now seeing 3 pids that kills my CPU with just "./cron" in the command.   I tried cd-ing into .X17-unix to see what's in there but it says the folder does not exist.  After killing the ./cron pid, it is quiet but I guess it will return at some point. The user is root so I can't kill this user, please help.
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
8780
This is a  about File Permission and Why 777 is "destructive".   I'm not asking how to fix this problem, as there are a ton of references of that already on Server Fault (reinstall OS). Why does it do anything destructive at all?  If you've ever ran this command you pretty much immediately destroy your operating system. I'm not clear why removing restrictions has any impact on existing processes. For example, if I don't have read access to something and after a quick mistype in the terminal suddenly I now have access well... why does that cause Linux to break?
22257
I have an hourly hour-long crontab job running with some mtr (traceroute) output every 10 minutes (that is going to go for over an hour prior to it being emailed back to me), and I want to see the current progress thus far.  On Linux, I have used lsof -n | fgrep cron (lsof is similar to BSD's fstat), and it seems like I might have found the file, but it is annotated as having been deleted (a standard practice for temporary files is to be deleted right after opening):  COMMAND     PID       USER   FD      TYPE     DEVICE  SIZE/OFF       NODE NAME ... cron      21742       root    5u      REG      202,0      7255      66310 /tmp/tmpfSuELzy (deleted)   And cannot be accesses by its prior name anymore:  # stat /tmp/tmpfSuELzy stat: cannot stat `/tmp/tmpfSuELzy': No such file or directory   How do I access such a deleted file that is still open?
34994
I have finally managed to boil down a problem I have been struggling with for a few weeks.  I use SSH with "authorized keys" to run commands remotely.  All is fine except when I do it in a while loop.  The loop terminates after completing any iteration with an ssh command.  For a long time I thought this was some kind of ksh weirdness, but I now discovered bash does in fact behave identically.  A small sample program to reproduce the problem.  This is distilled from a larger implementation which takes snapshots and replicates them amongst the nodes in a cluster.  #!/bin/bash  set -x  IDTAG=".*zone" MARKER="mark-$(date +%Y.%m.%d.%H.%M.%S)" REMOTE_HOST=sol10-target ZFSPARENT=rpool  ssh $REMOTE_HOST zfs list -t filesystem -rHo name,mounted $ZFSPARENT | grep "/$IDTAG    " &gt; /tmp/actionlist  #for RMT_FILESYSTEM in $(cat /tmp/actionlist) cat /tmp/actionlist | while read RMT_FILESYSTEM ISMOUNTED do    echo ${RMT_FILESYSTEM}@${MARKER}    [ "$ISMOUNTED" = "yes" ] &amp;&amp; ssh $REMOTE_HOST zfs snapshot -r ${RMT_FILESYSTEM}@${MARKER}    echo Remote Command Return Code: $? done   (Note there is a TAB character in the grep search expression as per the definition of the behaviour of the zfs list "-H" option.)  My sample have some ZFS filesystems for the root where all the "zones" have their root file system on a dataset named similar to  POOL/zones/app1zone POOL/zones/group2/app2zone    etc.  The above loop should create a snapshot for each of the selected datasets, but in stead it operates only on the first one and then exits.  That the program finds the right number of datasets can be easily confirm by checking the "/tmp/actionlist" file after the script exists.  If the ssh command is replaced by, for example, an echo command, then the loop iterates through all the input lines.  Or my favourite - prepend "echo" to the offending command.  If I use a for loop in stead then it also works, but due to the potential size of the list of datasets this could cause problems with the maximum expanded command line length.  I am now 99.999% sure that only those loops with ssh commands in them give me problems!  Note that the iteration in which the ssh command runs, completes! It is as if the data pipped in to the while loop is suddenly lost...  If the first few input lines don't perform an ssh command, then the loop goes on until it actually runs the SSH command.  On my laptop where I am testing this I have two Solaris 10 VMs with only about two or three sample datasets, but the same is happening on the large SPARC systems where this is meant to go live, and there are many datasets.
74732
I want to backup my home directory to an external drive nightly using a cron job to execute rsync.  I am unsure of the exact behavior of rsync's symbolic link flags.   rsync's -a flag includes the -l flag (i.e. "copy symlinks as symlinks").  Does this just mean it will copy the link or that it will follow the link and copy everything in the link-to directory?  I want to avoid that because I have links to directories full of media files that would involve copying hundreds of gigabytes I don't need to back up. Fearing (but not certain) that rsync -a would copy all those media files I instead added the --no-links flag.  This does not seem to be behavior I want.  It just ignores copying any link which is problematic because I do have links I want copied (e.g. links to common header files from different project directories). Assuming #1 above (without the --no-links flag) is what I really want and it just copies the link without copying the linked-to files, will the links break when they are backed up?  For example I may rsync source directory /home/me/projects/misc to /media/extdrive/backup/home/me/projects/misc.  In this case I assume rsync is not smart enough nor does it try to correct the contents of symlinks for the relative directory changes.  Is this correct?  This is okay, it doesn't matter if the links are broken in the backup directories so long as they would be fixed and working if such time comes when they need to be restored.
109915
I have a CRONTAB entry as below. Can someone tell me what the below statement is exactly doing?  1 0 * * * /vol01/sites/provisioning/MNMS/45627/45627.sh1 &gt;&gt; /vol01/sites/provisioning/MNMS/45627/output/cron.log 2&gt;&amp;1
93422
I tried to set up a root cron job to run a Bash script as root, to run at minute 7,37, every hour, every day of month, every month. This script is located in /usr/bin and named tunlrupdate.sh. It updates the DNS of Tunlr.  $ ls -l /usr/bin/tunlrupdate.sh  -rwxr-xr-x 1 root root 2133 Sep 24 15:42 /usr/bin/tunlrupdate.sh   This Bash script is available .  When invoked the script writes what's happening in a log located in /var/log/tunlr.log  To add this root cron job I used the standard for root's crontab  sudo crontab -e   And inserted these 2 lines at the end. I expect cron to run the script as root.  # check for updated Tunlr DNS every 30 minutes at the hour + 7 mn and hour + 37 mn 07,37 * * * * root /usr/bin/tunlrupdate.sh   A later command sudo crontab -l confirmed that the cron job has been inserted.  I did reboot Ubuntu and was checking in the log file if the cron job was launched properly. However there is nothing in the logfile /var/log/tunlr.log meaning the job was never successfully launched.  I did check that if I run the script from the command line  sudo /usr/bin/tunlrupdate.sh   then the logfile is updated accordingly.  Why is this cron job not running as planned in my system?  UPDATE 1 : All the proposed solutions so far do not work. I thank Olli for a CLI to list the system log sudo grep CRON /var/log/syslog. However I did get a CRON error  CRON[13092]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] &amp;&amp; [ -d /var/lib/php5 ] &amp;&amp; find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php /maxlifetime) ! -execdir fuser -s {} 2&gt;/dev/null \; -delete)   with the suggested PATH= insertion &amp; use of absolute path from root for functions in the script or without this suggested solutions here. I still get this error.  After some searching I pinpointed the error in the file /usr/lib/php5/maxlifetime as is explained : Change #!/bin/sh -e --&gt; #!/bin/sh -x  Then listing the CRON error log in my system  sudo grep CRON /var/log/syslog Feb 11 18:07:01 Marius-PC CRON[14067]: (root) CMD (root /usr/bin/tunlrupdate.sh) Feb 11 18:07:01 Marius-PC CRON[14066]: (root) MAIL (mailed 1 byte of output; but got status 0x00ff, #012)   I still don't get the bash script executing. This time no error is shown in the log. To get assurance this was not the content of the script I reduced the script to the following 3 lines:  #!/bin/bash LOGFILE=/var/log/tunlr.log echo $LOGFILE &gt;&gt; $LOGFILE   I still don't get the cron job through. Nothing is written in the log file. So even may be an empty script will not run in cron ? I don't get it. I am know trying a script reduced to these 2 lines:  #!/bin/bash exit 0   And still the same error log. The cron script does not go through ...
26578
What is the best way (options, those numbers on the end) to mount a /tmp partition in /etc/fstab in terms of security and speed on a desktop (laptop) computer (read: not server)?  I've heard about nosuid, nodev and noexec, but I have no idea what they do, how to use them or even if I should used them.  I'm using LVM btw.
112075
i've got a remote FTP server where i store some backups via cronjob.  The Problem is that i only got a little amount of space so im doing incremental backups. I want to keep the backups about 14 days.  I don't have any other access to the server except FTP and i don't now how to delete files older than x days. Every file got a name with a date in it  yxzNamezxy-date-y-m-d.tar.bz2 (datev-20100111.tar.bz2(   Hope to get some help here.  Cheers and thanks for the hopefully coming answeres,  Dennis  /Edit  I'm trying to use the curl thing which is mantioned in an answere with this part of code  curl ftp://$FTP_SERVER --user $FTP_USER:$FTP_PASS --list-only &gt; files.tmp declare -a aFiles let iCount=0 exec &lt; files.tmp while read sLine do         aFiles[$iCount]=$sLine         ((iCount++)) done  echo -e "\n Files: \n\n\n" echo ${aFiles[@]}  echo -e "\nfor ...\n\n\n" for sFile in $aFiles do         echo -e "\nFile:" $sFile done   but the secound loop doesn't give me more than 1 filename  Cheers,  Dennis
41756
I'm trying to compress a folder (/var/www/) to ~/www_backups/$time.tar where $time is the current date.  This is what I have:  cd /var/www &amp;&amp; sudo tar -czf ~/www_backups $time"   I am completely lost and I've been at this for hours now. Not sure if -czf is correct. I simply want to copy all of the content in /var/www into a $time.tar file, and I want to maintain the file permissions for all of the files. Can anyone help me out?
43827
The following crontab does not work:  # TEST LINE DOES DOT RUN */1 * * * * /bin/echo 'test '`/bin/date +%Y-%m-%d` &gt;&gt; /tmp/test   I also tried starting it with:  SHELL=/bin/bash   Update: I thought the backtick characters ` were the villains, but as the answer below clarifies the percentage % was the culprit!
8963
Related question:   Answer from there helped me a lot, this command does what I need:  ssh -R 2225:localhost:22 loginOfServerWithPublicIP@publicIP   So I wrote the script to reconnect all the time:   #!/bin/bash   while true; do     echo "try to connect..."     ssh -o ServerAliveInterval=240 -R 2225:localhost:22 user@host     echo "restarting in 5 seconds.."     sleep 5  done   And added it to the /etc/crontab. But I found out that works if only I execute it "by hand" from shell, but if it is called by cron, ssh connects and immediately finishes. (so, the script above reconnects all the time)  From man ssh, I found that for background connections I should call it with -n key, but it didn't help. Then, I just looked around for similar scripts and I found that it works if I call tail -f something, i.e. some "neverending" command, so I just created empty file /tmp/dummy_file and now my ssh command looks like this:  ssh -o ServerAliveInterval=240 -R 2225:localhost:22 -n user@host tail -f /tmp/dummy_file   It works now! But, this solution seems a bit ugly, plus I don't really understand actual reasons of that behavior. Just by chance, I tried to call bash instead of tail -f (bash seems to me "neverending" command, too), but it doesn't work.  So, could anyone please explain this behavior, and what is the correct way to create background ssh connection to keep reverse ssh tunnel up?
53899
I accidentally "stopped" my telnet process.  Now I can neither "switch back" into it, nor can I kill it (it won't respond to kill 92929, where 92929 is the processid.)  So, my question is, if you have a stopped process on linux command line, how do you switch back into it, or kill it, without having to resort to kill -9?
9099
I have no clue, but lately I've been having this problem. After running my workstation suddenly something destroys PATH and lots of stuff stops working. Initially, my path had MANY directories listed (I use Windows 7 as a development box) and after some time, I only had 3-4 directories listed in my path left.  I can't even open the System Properties dialog where I can see environment variables (because it uses shell variables to start it and it doesn't work). In short, I reboot every time.   Any ideas what might cause that problem? I didn't run anything new/unusual lately. Only VmWare (but I've been using it in the past and didn't have that problem back then).  I just checked, even %WINDIR% is not defined. WTF?!
37848
I am trying to automate the refreshing of awstats for my webserver and understand that I need to use cron to set that up.  So each user has a crontab file? I was following the instructions  community/AWStats And it says to go to the file at: /etc/crontab That file already has some information in it.  Is this the main crontab file or something?  I have seen some instructions online to use the file that pops up with crontab -e. What is the proper file to use and the best way to do this? If I schedule a task as my non-root user, will it run by itself at the time interval as specified, with no issues? Will I need to restart the server after saving the cron job in the crontab file before it will start working?
4716
[root@datacenteronline ~]# ssh root@192.168.1.172 Last login: Wed Apr 17 09:55:45 2013 from 192.168.1.187 [root@localhost ~]# ls /proc/ | grep 2266 [root@localhost ~]# cd /proc/2266 [root@localhost 2266]# ls attr             cpuset   limits      net            root       statm autogroup        cwd      loginuid    numa_maps      sched      status auxv             environ  maps        oom_adj        schedstat  syscall cgroup           exe      mem         oom_score      sessionid  task clear_refs       fd       mountinfo   oom_score_adj  smaps      wchan cmdline          fdinfo   mounts      pagemap        stack coredump_filter  io       mountstats  personality    stat [root@localhost 2266]# ls -al /proc/2266 total 0 dr-xr-xr-x   7 apache apache 0 Apr 17 09:45 . dr-xr-xr-x 266 root   root   0 Apr 17 09:11 .. dr-xr-xr-x   2 apache apache 0 Apr 17 09:45 attr -rw-r--r--   1 root   root   0 Apr 17 09:45 autogroup -r--------   1 root   root   0 Apr 17 09:45 auxv -r--r--r--   1 root   root   0 Apr 17 09:45 cgroup --w-------   1 root   root   0 Apr 17 09:45 clear_refs -r--r--r--   1 root   root   0 Apr 17 09:45 cmdline -rw-r--r--   1 root   root   0 Apr 17 09:45 coredump_filter -r--r--r--   1 root   root   0 Apr 17 09:45 cpuset lrwxrwxrwx   1 root   root   0 Apr 17 09:45 cwd -&gt; / -r--------   1 root   root   0 Apr 17 09:45 environ lrwxrwxrwx   1 root   root   0 Apr 17 09:45 exe -&gt; /usr/local/apache2/bin/httpd dr-x------   2 root   root   0 Apr 17 09:45 fd dr-x------   2 root   root   0 Apr 17 09:45 fdinfo -r--------   1 root   root   0 Apr 17 09:45 io -rw-------   1 root   root   0 Apr 17 09:45 limits -rw-r--r--   1 root   root   0 Apr 17 09:45 loginuid -r--r--r--   1 root   root   0 Apr 17 09:45 maps -rw-------   1 root   root   0 Apr 17 09:45 mem -r--r--r--   1 root   root   0 Apr 17 09:45 mountinfo -r--r--r--   1 root   root   0 Apr 17 09:45 mounts -r--------   1 root   root   0 Apr 17 09:45 mountstats dr-xr-xr-x   6 apache apache 0 Apr 17 09:45 net -r--r--r--   1 root   root   0 Apr 17 09:45 numa_maps -rw-r--r--   1 root   root   0 Apr 17 09:45 oom_adj -r--r--r--   1 root   root   0 Apr 17 09:45 oom_score -rw-r--r--   1 root   root   0 Apr 17 09:45 oom_score_adj -r--r--r--   1 root   root   0 Apr 17 09:45 pagemap -r--r--r--   1 root   root   0 Apr 17 09:45 personality lrwxrwxrwx   1 root   root   0 Apr 17 09:45 root -&gt; / -rw-r--r--   1 root   root   0 Apr 17 09:45 sched -r--r--r--   1 root   root   0 Apr 17 09:45 schedstat -r--r--r--   1 root   root   0 Apr 17 09:45 sessionid -r--r--r--   1 root   root   0 Apr 17 09:45 smaps -r--r--r--   1 root   root   0 Apr 17 09:45 stack -r--r--r--   1 root   root   0 Apr 17 09:45 stat -r--r--r--   1 root   root   0 Apr 17 09:45 statm -r--r--r--   1 root   root   0 Apr 17 09:45 status -r--r--r--   1 root   root   0 Apr 17 09:45 syscall dr-xr-xr-x  29 apache apache 0 Apr 17 09:45 task -r--r--r--   1 root   root   0 Apr 17 09:45 wchan   Cound anyone tell me what it is?
123757
I have a script run from a non-privileged users' crontab that invokes some commands using sudo. Except it doesn't. The script runs fine but the sudo'ed commands silently fail.   The script runs perfectly from a shell as the user in question. Sudo does not require a password. The user in question has (root) NOPASSWD: ALL access granted in /etc/sudoers. Cron is running and executing the script. Adding a simple date &gt; /tmp/log produces output at the right time. It's not a permissions problem. Again the script does get executed, just not the sudo'ed commands. It's not a path problem. Running env from inside the script being run shows the correct $PATH variable that includes the path to sudo. Running it using a full path doesn't help. The command being executed is being given the full path name. Trying to capture the output of the sudo command including STDERR doesn't show anything useful. Adding sudo echo test 2&gt;&amp;1 &gt; /tmp/log to the script produces a blank log. The sudo binary itself executes fine and recognizes that it has permissions even when run from cron inside the script. Adding sudo -l &gt; /tmp/log to the script produces the output:       User ec2-user may run the following commands on this host:   (root) NOPASSWD: ALL    Examining the exit code of the command using $? shows it is returning an error (exit code: 1), but no error seems to be produced. A command as simple as /usr/bin/sudo /bin/echo test returns the same error code.  What else could be going on?  This is a recently created virtual machine running the latest Amazon Linux AMI. The crontab belongs to the user ec2-user and the sudoers file is the distribution default.