On Wed, Sep 28, 2005 at 06:33:24PM -0000, sf_submit (at) yahoo (dot) com [email concealed] wrote:
> Fairly recently I noticed my ftp client wouldn't list files in certain
> directories on my server anymore - so I ssh'd in (it's dedicated), and
> did a ls -aFl on the files, hoping to see what the problem was - here
> are a few of the results:
>
> -rw-r--r-- 1 larry 503 371 2005-02-25 08:36 head.php
> -rw-r--r-- 1 larry 48 873 2005-09-09 03:23 foot.php
>
> I never set the group ids to 503 or 48, so I checked just to make sure
> - and no groups with those ids even exist. Is there an exploit/tool
> that causes this, and should I be worried?
>
> I checked the processes running, and everything seems to be OK - same
> with any processes connecting to the internet.
A remote possibility: This is normal when the partition is an
nfs-mounted partition and the files were on the nfs-server of which the
uid's and gid's are not identical to that of the nfs-client.
Coming from an ftp-administrators who for years had to use nfs-mounted
volumes because of lack of storage space :)
Regards
Johann
--
*********************************************************************
Johann Spies and Gerhard van Wageningen
System Administrator * Email: sysadm (at) sun.ac (dot) za [email concealed]
UNIX Systems *
University of Stellenbosch * Tel: (+27 21 808)4036(J) / 4554(G)
*********************************************************************
> Fairly recently I noticed my ftp client wouldn't list files in certain
> directories on my server anymore - so I ssh'd in (it's dedicated), and
> did a ls -aFl on the files, hoping to see what the problem was - here
> are a few of the results:
>
> -rw-r--r-- 1 larry 503 371 2005-02-25 08:36 head.php
> -rw-r--r-- 1 larry 48 873 2005-09-09 03:23 foot.php
>
> I never set the group ids to 503 or 48, so I checked just to make sure
> - and no groups with those ids even exist. Is there an exploit/tool
> that causes this, and should I be worried?
>
> I checked the processes running, and everything seems to be OK - same
> with any processes connecting to the internet.
A remote possibility: This is normal when the partition is an
nfs-mounted partition and the files were on the nfs-server of which the
uid's and gid's are not identical to that of the nfs-client.
Coming from an ftp-administrators who for years had to use nfs-mounted
volumes because of lack of storage space :)
Regards
Johann
--
*********************************************************************
Johann Spies and Gerhard van Wageningen
System Administrator * Email: sysadm (at) sun.ac (dot) za [email concealed]
UNIX Systems *
University of Stellenbosch * Tel: (+27 21 808)4036(J) / 4554(G)
*********************************************************************
[ reply ]