Титла: rc.local ичезна?
Публикувано от: Astor в Jun 11, 2010, 10:56
Здравейте, става дума за един Slackware 13.0 линукс компютър, на който имаше няколко услуги пуснати. Вчера (или то си е днес) до 1:00 ч. всичко си работеше, защото ползвах сървъра, а тази сутрин в 10ч. виждам че политиките в iptables са нулирани. Оказа се че в /etc/rc.d/ няма файл rc.local?!?!? ??? Как е изчезнал? И щом са се нулирали политиките на iptables предполагам че е имало рестарт, след който не е намерил rc.local файлът и за това е така положението. Кой може да е изтрил този файл? Някой процес или дори човек? Как мога да разбера това и защо се е получило? Мога ли да разбера кога е рестартиран последно компютъра например? Или кога някой е влизал през ssh?
Ако случайно не може да се разбере как е изчезнал може ли да кажете какви политики трябва да му задам за да предотвратя последващо изтриване? Чия собственост трябва да е този файл и обикновенните потребители трябва ли да имат права +x, за да се изпълнява при рестартиране на компютъра?
Благодаря ви предварително
Титла: Re: rc.local ичезна?
Публикувано от: b2l в Jun 11, 2010, 10:59
Титла: Re: rc.local ичезна?
Публикувано от: Astor в Jun 11, 2010, 11:39
root@astor:/home/astor# last
astor ftpd3395 192.168.0.102 Fri Jun 11 11:20 gone - no logout
astor ftpd3394 192.168.0.102 Fri Jun 11 11:20 still logged in
astor pts/0 192.168.0.102 Fri Jun 11 11:14 still logged in
astor ftpd3357 192.168.0.102 Fri Jun 11 10:35 gone - no logout
astor ftpd3356 192.168.0.102 Fri Jun 11 10:35 gone - no logout
astor ftpd3354 127.0.0.1 Fri Jun 11 10:35 gone - no logout
astor pts/0 192.168.0.102 Fri Jun 11 10:22 - 10:57 (00:35)
reboot system boot 2.6.29.6-smp Fri Jun 11 03:19 (08:01)
astor ftpd5262 88.80.5.234 Fri Jun 11 00:30 - crash (02:49)
astor ftpd5261 88.80.5.234 Fri Jun 11 00:30 - crash (02:49)
astor ftpd5259 88.80.5.234 Fri Jun 11 00:22 - crash (02:57)
astor ftpd5258 88.80.5.234 Fri Jun 11 00:22 - crash (02:57)
astor ftpd5117 88.80.5.234 Wed Jun 9 23:22 - crash (1+03:56)
astor ftpd5116 88.80.5.234 Wed Jun 9 23:22 - crash (1+03:56)
astor ftpd5115 88.80.5.234 Wed Jun 9 23:22 - crash (1+03:56)
Ето какво пише в /var/log/messages: skipping 2 old session files
reading /var/log/messages
Jun 6 04:40:02 darkstar syslogd 1.4.1: restart.
Jun 6 05:02:14 darkstar -- MARK --
Jun 6 05:22:14 darkstar -- MARK --
Jun 11 02:42:25 darkstar -- MARK --
Jun 11 03:02:25 darkstar -- MARK --
Jun 11 03:19:45 darkstar syslogd 1.4.1: restart.
Jun 11 03:19:45 darkstar kernel: klogd 1.4.1, log source = /proc/kmsg started.
Jun 11 03:19:45 darkstar kernel: n NUMA node 0
Jun 11 03:19:45 darkstar kernel: ACPI: PCI Interrupt Link [LNKA] (IRQs 3 4 5 6 7 *9 10 11 14 15)
Jun 11 03:19:45 darkstar kernel: ACPI: PCI Interrupt Link [LNKB] (IRQs 3 4 5 6 7 9 10 *11 14 15)
Jun 11 03:19:45 darkstar kernel: ACPI: PCI Interrupt Link [LNKC] (IRQs 3 4 5 6 7 9 *10 11 14 15)
Jun 11 03:19:45 darkstar kernel: ACPI: PCI Interrupt Link [LNKD] (IRQs 3 4 *5 6 7 9 10 11 14 15)
Jun 11 03:19:45 darkstar kernel: SCSI subsystem initialized
Jun 11 03:19:45 darkstar kernel: usbcore: registered new interface driver usbfs
Jun 11 03:19:45 darkstar kernel: usbcore: registered new interface driver hub
Jun 11 03:19:45 darkstar kernel: usbcore: registered new device driver usb
Jun 11 03:19:45 darkstar kernel: PCI: Using ACPI for IRQ routing
Jun 11 03:19:45 darkstar kernel: pnp: PnP ACPI init
Jun 11 03:19:45 darkstar kernel: ACPI: bus type pnp registered
Jun 11 03:19:45 darkstar kernel: pnp: PnP ACPI: found 13 devices
Jun 11 03:19:45 darkstar kernel: ACPI: ACPI bus type pnp unregistered
Jun 11 03:19:45 darkstar kernel: system 00:01: ioport range 0x1000-0x103f has been reserved
Jun 11 03:19:45 darkstar kernel: system 00:01: ioport range 0x1040-0x104f has been reserved
Jun 11 03:19:45 darkstar kernel: system 00:01: ioport range 0xcf0-0xcf1 has been reserved
Jun 11 03:19:45 darkstar kernel: system 00:0c: ioport range 0x1060-0x107f has been reserved
Jun 11 03:19:45 darkstar kernel: system 00:0c: iomem range 0xe0000000-0xefffffff has been reserved
Jun 11 03:19:45 darkstar kernel: system 00:0c: iomem range 0xdbe00000-0xdbffffff has been reserved
Jun 11 03:19:45 darkstar kernel: pci 0000:00:01.0: PCI bridge, secondary bus 0000:01
Jun 11 03:19:45 darkstar kernel: pci 0000:00:01.0: IO window: disabled
Jun 11 03:19:45 darkstar kernel: pci 0000:00:01.0: MEM window: disabled
Jun 11 03:19:45 darkstar kernel: pci 0000:00:01.0: PREFETCH window: disabled
Jun 11 03:19:45 darkstar kernel: pci 0000:00:11.0: PCI bridge, secondary bus 0000:02
Jun 11 03:19:45 darkstar kernel: pci 0000:00:11.0: IO window: 0x2000-0x3fff
Jun 11 03:19:45 darkstar kernel: pci 0000:00:11.0: MEM window: 0xd8900000-0xd9cfffff
Jun 11 03:19:45 darkstar kernel: pci 0000:00:11.0: PREFETCH window: 0x000000dc400000-0x000000dc9fffff
Jun 11 03:19:45 darkstar kernel: pci 0000:00:15.0: PCI bridge, secondary bus 0000:03
Jun 11 03:19:45 darkstar kernel: pci 0000:00:15.0: IO window: 0x4000-0x4fff
Jun 11 03:19:45 darkstar kernel: pci 0000:00:15.0: MEM window: 0xd9d00000-0xd9dfffff
Jun 11 03:19:45 darkstar kernel: pci 0000:00:15.0: PREFETCH window: 0x000000dca00000-0x000000dcafffff
........................
Това се повтаря още много пъти
........................
Jun 11 03:19:45 darkstar kernel: NET: Registered protocol family 2
Jun 11 03:19:45 darkstar kernel: IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
Jun 11 03:19:45 darkstar kernel: TCP established hash table entries: 8192 (order: 4, 65536 bytes)
Jun 11 03:19:45 darkstar kernel: TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
Jun 11 03:19:45 darkstar kernel: TCP: Hash tables configured (established 8192 bind 8192)
Jun 11 03:19:45 darkstar kernel: TCP reno registered
Jun 11 03:19:45 darkstar kernel: NET: Registered protocol family 1
Jun 11 03:19:45 darkstar kernel: Simple Boot Flag at 0x36 set to 0x1
Jun 11 03:19:45 darkstar kernel: VFS: Disk quotas dquot_6.5.2
Jun 11 03:19:45 darkstar kernel: NTFS driver 2.1.29 [Flags: R/W].
Jun 11 03:19:45 darkstar kernel: JFS: nTxBlock = 1944, nTxLock = 15552
Jun 11 03:19:45 darkstar kernel: SGI XFS with ACLs, security attributes, large block/inode numbers, no debug enabled
Jun 11 03:19:45 darkstar kernel: SGI XFS Quota Management subsystem
Jun 11 03:19:45 darkstar kernel: msgmni has been set to 486
Jun 11 03:19:45 darkstar kernel: alg: No test for cipher_null (cipher_null-generic)
Jun 11 03:19:45 darkstar kernel: alg: No test for digest_null (digest_null-generic)
Jun 11 03:19:45 darkstar kernel: alg: No test for compress_null (compress_null-generic)
Jun 11 03:19:45 darkstar kernel: alg: No test for fcrypt (fcrypt-generic)
Jun 11 03:19:45 darkstar kernel: alg: No test for stdrng (krng)
Jun 11 03:19:45 darkstar kernel: async_tx: api initialized (async)
Jun 11 03:19:45 darkstar kernel: Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
Jun 11 03:19:45 darkstar kernel: io scheduler noop registered
Jun 11 03:19:45 darkstar kernel: io scheduler anticipatory registered
Jun 11 03:19:45 darkstar kernel: io scheduler deadline registered
Jun 11 03:19:45 darkstar kernel: io scheduler cfq registered (default)
Jun 11 03:19:45 darkstar kernel: pci 0000:00:00.0: Limiting direct PCI/PCI transfers
Jun 11 03:19:45 darkstar kernel: pci_hotplug: PCI Hot Plug PCI Core version: 0.5
Jun 11 03:19:45 darkstar kernel: isapnp: Scanning for PnP cards...
Jun 11 03:19:45 darkstar kernel: isapnp: No Plug & Play device found
Jun 11 03:19:45 darkstar kernel: Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
Jun 11 03:19:45 darkstar kernel: serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
Jun 11 03:19:45 darkstar kernel: serial8250: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A
Jun 11 03:19:45 darkstar kernel: 00:09: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
Jun 11 03:19:45 darkstar kernel: 00:0a: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A
Jun 11 03:19:45 darkstar kernel: Floppy drive(s): fd0 is 1.44M
Jun 11 03:19:45 darkstar kernel: FDC 0 is a post-1991 82077
Jun 11 03:19:45 darkstar kernel: brd: module loaded
Jun 11 03:19:45 darkstar kernel: loop: module loaded
Jun 11 03:19:45 darkstar kernel: HP CISS Driver (v 3.6.20)
Jun 11 03:19:45 darkstar kernel: input: Macintosh mouse button emulation as /devices/virtual/input/input0
Jun 11 03:19:45 darkstar kernel: Uniform Multi-Platform E-IDE driver
Jun 11 03:19:45 darkstar kernel: piix 0000:00:07.1: IDE controller (0x8086:0x7111 rev 0x01)
Jun 11 03:19:45 darkstar kernel: piix 0000:00:07.1: not 100%% native mode: will probe irqs later
Jun 11 03:19:45 darkstar kernel: ide0: BM-DMA at 0x10c0-0x10c7
Jun 11 03:19:45 darkstar kernel: ide1: BM-DMA at 0x10c8-0x10cf
Jun 11 03:19:45 darkstar kernel: hda: VMware Virtual IDE Hard Drive, ATA DISK drive
Jun 11 03:19:45 darkstar kernel: hda: UDMA/33 mode selected
Jun 11 03:19:45 darkstar kernel: hdc: VMware Virtual IDE CDROM Drive, ATAPI CD/DVD-ROM drive
Jun 11 03:19:45 darkstar kernel: hdc: UDMA/33 mode selected
Jun 11 03:19:45 darkstar kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
Jun 11 03:19:45 darkstar kernel: ide1 at 0x170-0x177,0x376 on irq 15
Jun 11 03:19:45 darkstar kernel: ide-gd driver 1.18
Jun 11 03:19:45 darkstar kernel: hda: max request size: 128KiB
Jun 11 03:19:45 darkstar kernel: hda: 41943040 sectors (21474 MB) w/32KiB Cache, CHS=44384/15/63
Jun 11 03:19:45 darkstar kernel: hda: hda1 hda2
Jun 11 03:19:45 darkstar kernel: ide-cd driver 5.00
Jun 11 03:19:45 darkstar kernel: ide-cd: hdc: ATAPI 1X CD-ROM drive, 32kB Cache
Jun 11 03:19:45 darkstar kernel: Uniform CD-ROM driver Revision: 3.20
Jun 11 03:19:45 darkstar kernel: Loading iSCSI transport class v2.0-870.
Jun 11 03:19:45 darkstar kernel: rdac: device handler registered
Jun 11 03:19:45 darkstar kernel: hp_sw: device handler registered
Jun 11 03:19:45 darkstar kernel: emc: device handler registered
Jun 11 03:19:45 darkstar kernel: alua: device handler registered
Jun 11 03:19:45 darkstar kernel: Adaptec aacraid driver 1.1-5[2456]-ms
Jun 11 03:19:45 darkstar kernel: sym53c416.c: Version 1.0.0-ac
Jun 11 03:19:45 darkstar kernel: qlogicfas: no cards were found, please specify I/O address and IRQ using iobase= and irq= options<6>QLogic Fibre Channel HBA Driver: 8.03.00-k4
Jun 11 03:19:45 darkstar kernel: iscsi: registered transport (qla4xxx)
Jun 11 03:19:45 darkstar kernel: QLogic iSCSI HBA Driver
Jun 11 03:19:45 darkstar kernel: pci 0000:00:10.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
Jun 11 03:19:45 darkstar kernel: DC390: clustering now enabled by default. If you get problems load
Jun 11 03:19:45 darkstar kernel: with "disable_clustering=1" and report to maintainers
Jun 11 03:19:45 darkstar kernel: megaraid cmm: 2.20.2.7 (Release Date: Sun Jul 16 00:01:03 EST 2006)
Jun 11 03:19:45 darkstar kernel: megaraid: 2.20.5.1 (Release Date: Thu Nov 16 15:32:35 EST 2006)
Jun 11 03:19:45 darkstar kernel: megasas: 00.00.04.01 Thu July 24 11:41:51 PST 2008
Jun 11 03:19:45 darkstar kernel: nsp32: loading...
Jun 11 03:19:45 darkstar kernel: ipr: IBM Power RAID SCSI Device Driver version: 2.4.1 (April 24, 2007)
Jun 11 03:19:45 darkstar kernel: RocketRAID 3xxx/4xxx Controller driver v1.3 (071203)
Jun 11 03:19:45 darkstar kernel: stex: Promise SuperTrak EX Driver version: 3.6.0000.1
Jun 11 03:19:45 darkstar kernel: st: Version 20081215, fixed bufsize 32768, s/g segs 256
Jun 11 03:19:45 darkstar kernel: I2O subsystem v1.325
Jun 11 03:19:45 darkstar kernel: i2o: max drivers = 8
Jun 11 03:19:45 darkstar kernel: I2O Configuration OSM v1.323
Jun 11 03:19:45 darkstar kernel: I2O Bus Adapter OSM v1.317
Jun 11 03:19:45 darkstar kernel: I2O Block Device OSM v1.325
Jun 11 03:19:45 darkstar kernel: I2O SCSI Peripheral OSM v1.316
Jun 11 03:19:45 darkstar kernel: I2O ProcFS OSM v1.316
Jun 11 03:19:45 darkstar kernel: Fusion MPT base driver 3.04.07
Jun 11 03:19:45 darkstar kernel: Copyright (c) 1999-2008 LSI Corporation
Jun 11 03:19:45 darkstar kernel: Fusion MPT SPI Host driver 3.04.07
Jun 11 03:19:45 darkstar kernel: mptbase: ioc0: Initiating bringup
Jun 11 03:19:45 darkstar kernel: ioc0: LSI53C1030 B0: Capabilities={Initiator}
Jun 11 03:19:45 darkstar kernel: scsi2 : ioc0: LSI53C1030 B0, FwRev=01032920h, Ports=1, MaxQ=128, IRQ=17
Jun 11 03:19:45 darkstar kernel: Fusion MPT FC Host driver 3.04.07
Jun 11 03:19:45 darkstar kernel: Fusion MPT SAS Host driver 3.04.07
Jun 11 03:19:45 darkstar kernel: ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Jun 11 03:19:45 darkstar kernel: ehci_hcd 0000:02:03.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
Jun 11 03:19:45 darkstar kernel: ehci_hcd 0000:02:03.0: EHCI Host Controller
Jun 11 03:19:45 darkstar kernel: ehci_hcd 0000:02:03.0: new USB bus registered, assigned bus number 1
Jun 11 03:19:45 darkstar kernel: ehci_hcd 0000:02:03.0: irq 17, io mem 0xd8900000
Jun 11 03:19:45 darkstar kernel: ehci_hcd 0000:02:03.0: USB 2.0 started, EHCI 1.00
Jun 11 03:19:45 darkstar kernel: usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
Jun 11 03:19:45 darkstar kernel: usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
Jun 11 03:19:45 darkstar kernel: usb usb1: Product: EHCI Host Controller
Jun 11 03:19:45 darkstar kernel: usb usb1: Manufacturer: Linux 2.6.29.6-smp ehci_hcd
Jun 11 03:19:45 darkstar kernel: usb usb1: SerialNumber: 0000:02:03.0
Jun 11 03:19:45 darkstar kernel: usb usb1: configuration #1 chosen from 1 choice
Jun 11 03:19:45 darkstar kernel: hub 1-0:1.0: USB hub found
Jun 11 03:19:45 darkstar kernel: hub 1-0:1.0: 6 ports detected
Jun 11 03:19:45 darkstar kernel: 116x: driver isp116x-hcd, 03 Nov 2005
Jun 11 03:19:45 darkstar kernel: ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
Jun 11 03:19:45 darkstar kernel: uhci_hcd: USB Universal Host Controller Interface driver
Jun 11 03:19:45 darkstar kernel: uhci_hcd 0000:02:00.0: PCI INT A -> GSI 18 (level, low) -> IRQ 18
Jun 11 03:19:45 darkstar kernel: uhci_hcd 0000:02:00.0: UHCI Host Controller
Jun 11 03:19:45 darkstar kernel: uhci_hcd 0000:02:00.0: new USB bus registered, assigned bus number 2
Jun 11 03:19:45 darkstar kernel: uhci_hcd 0000:02:00.0: irq 18, io base 0x000020c0
Jun 11 03:19:45 darkstar kernel: usb usb2: New USB device found, idVendor=1d6b, idProduct=0001
Jun 11 03:19:45 darkstar kernel: usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
Jun 11 03:19:45 darkstar kernel: usb usb2: Product: UHCI Host Controller
Jun 11 03:19:45 darkstar kernel: usb usb2: Manufacturer: Linux 2.6.29.6-smp uhci_hcd
Jun 11 03:19:45 darkstar kernel: usb usb2: SerialNumber: 0000:02:00.0
Jun 11 03:19:45 darkstar kernel: usb usb2: configuration #1 chosen from 1 choice
Jun 11 03:19:45 darkstar kernel: hub 2-0:1.0: USB hub found
Jun 11 03:19:45 darkstar kernel: hub 2-0:1.0: 2 ports detected
Jun 11 03:19:45 darkstar kernel: sl811: driver sl811-hcd, 19 May 2005
Jun 11 03:19:45 darkstar kernel: r8a66597_hcd: driver r8a66597_hcd, 10 Apr 2008
Jun 11 03:19:45 darkstar kernel: Initializing USB Mass Storage driver...
Jun 11 03:19:45 darkstar kernel: usbcore: registered new interface driver usb-storage
Jun 11 03:19:45 darkstar kernel: USB Mass Storage support registered.
Jun 11 03:19:45 darkstar kernel: PNP: PS/2 Controller [PNP0303:KBC,PNP0f13:MOUS] at 0x60,0x64 irq 1,12
Jun 11 03:19:45 darkstar kernel: serio: i8042 KBD port at 0x60,0x64 irq 1
Jun 11 03:19:45 darkstar kernel: serio: i8042 AUX port at 0x60,0x64 irq 12
Jun 11 03:19:45 darkstar kernel: mice: PS/2 mouse device common for all mice
Jun 11 03:19:45 darkstar kernel: i2c /dev entries driver
Jun 11 03:19:45 darkstar kernel: md: linear personality registered for level -1
Jun 11 03:19:45 darkstar kernel: md: raid0 personality registered for level 0
Jun 11 03:19:45 darkstar kernel: md: raid1 personality registered for level 1
Jun 11 03:19:45 darkstar kernel: md: raid10 personality registered for level 10
Jun 11 03:19:45 darkstar kernel: md: raid6 personality registered for level 6
Jun 11 03:19:45 darkstar kernel: md: raid5 personality registered for level 5
Jun 11 03:19:45 darkstar kernel: md: raid4 personality registered for level 4
Jun 11 03:19:45 darkstar kernel: md: multipath personality registered for level -4
Jun 11 03:19:45 darkstar kernel: input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
Jun 11 03:19:45 darkstar kernel: device-mapper: ioctl: 4.14.0-ioctl (2008-04-23) initialised: dm-devel@redhat.com
Jun 11 03:19:45 darkstar kernel: cpuidle: using governor ladder
Jun 11 03:19:45 darkstar kernel: usbcore: registered new interface driver hiddev
Jun 11 03:19:45 darkstar kernel: usbcore: registered new interface driver usbhid
Jun 11 03:19:45 darkstar kernel: usbhid: v2.6:USB HID core driver
Jun 11 03:19:45 darkstar kernel: TCP cubic registered
Jun 11 03:19:45 darkstar kernel: Initializing XFRM netlink socket
Jun 11 03:19:45 darkstar kernel: NET: Registered protocol family 17
Jun 11 03:19:45 darkstar kernel: RPC: Registered udp transport module.
Jun 11 03:19:45 darkstar kernel: RPC: Registered tcp transport module.
Jun 11 03:19:45 darkstar kernel: Using IPI No-Shortcut mode
Jun 11 03:19:45 darkstar kernel: md: Waiting for all devices to be available before autodetect
Jun 11 03:19:45 darkstar kernel: md: If you don't use raid, use raid=noautodetect
Jun 11 03:19:45 darkstar kernel: md: Autodetecting RAID arrays.
Jun 11 03:19:45 darkstar kernel: md: Scanned 0 and added 0 devices.
Jun 11 03:19:45 darkstar kernel: md: autorun ...
Jun 11 03:19:45 darkstar kernel: md: ... autorun DONE.
Jun 11 03:19:45 darkstar kernel: EXT4-fs: INFO: recovery required on readonly filesystem.
Jun 11 03:19:45 darkstar kernel: EXT4-fs: write access will be enabled during recovery.
Jun 11 03:19:45 darkstar kernel: EXT4-fs: barriers enabled
Jun 11 03:19:45 darkstar kernel: kjournald2 starting: pid 1472, dev hda1:8, commit interval 5 seconds
Jun 11 03:19:45 darkstar kernel: EXT4-fs: delayed allocation enabled
Jun 11 03:19:45 darkstar kernel: EXT4-fs: file extents enabled
Jun 11 03:19:45 darkstar kernel: EXT4-fs: mballoc enabled
Jun 11 03:19:45 darkstar kernel: EXT4-fs: recovery complete.
Jun 11 03:19:45 darkstar kernel: EXT4-fs: mounted filesystem hda1 with ordered data mode
Jun 11 03:19:45 darkstar kernel: Freeing unused kernel memory: 456k freed
Jun 11 03:19:45 darkstar kernel: input: Power Button (FF) as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input2
Jun 11 03:19:45 darkstar kernel: ACPI: Power Button (FF) [PWRF]
Jun 11 03:19:45 darkstar kernel: ACPI: AC Adapter [ACAD] (on-line)
Jun 11 03:19:45 darkstar kernel: processor ACPI_CPU:00: registered as cooling_device0
Jun 11 03:19:45 darkstar kernel: ACPI: Processor [CP00] (supports 8 throttling states)
Jun 11 03:19:45 darkstar kernel: rtc_cmos 00:04: rtc core: registered rtc_cmos as rtc0
Jun 11 03:19:45 darkstar kernel: rtc0: alarms up to one month, y3k, 114 bytes nvram
Jun 11 03:19:45 darkstar kernel: Linux agpgart interface v0.103
Jun 11 03:19:45 darkstar kernel: ACPI: Device needs an ACPI driver
Jun 11 03:19:45 darkstar kernel: agpgart-intel 0000:00:00.0: Intel 440BX Chipset
Jun 11 03:19:45 darkstar kernel: agpgart-intel 0000:00:00.0: AGP aperture is 256M @ 0x0
Jun 11 03:19:45 darkstar kernel: parport_pc 00:08: reported by Plug and Play ACPI
Jun 11 03:19:45 darkstar kernel: parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
Jun 11 03:19:45 darkstar kernel: shpchp: Standard Hot Plug PCI Controller Driver version: 0.4
Jun 11 03:19:45 darkstar kernel: pcnet32.c:v1.35 21.Apr.2008 tsbogend@alpha.franken.de
Jun 11 03:19:45 darkstar kernel: pcnet32 0000:02:01.0: PCI INT A -> GSI 19 (level, low) -> IRQ 19
Jun 11 03:19:45 darkstar kernel: pcnet32: PCnet/PCI II 79C970A at 0x2000, 00:0c:29:57:60:cc assigned IRQ 19.
Jun 11 03:19:45 darkstar kernel: eth0: registered as PCnet/PCI II 79C970A
Jun 11 03:19:45 darkstar kernel: pcnet32: 1 cards_found.
Jun 11 03:19:45 darkstar kernel: ENS1371 0000:02:02.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
Jun 11 03:19:45 darkstar kernel: input: ImPS/2 Generic Wheel Mouse as /devices/platform/i8042/serio1/input/input3
Jun 11 03:19:45 darkstar kernel: ppdev: user-space parallel port driver
Jun 11 03:19:45 darkstar kernel: Adding 522104k swap on /dev/hda2. Priority:-1 extents:1 across:522104k
Jun 11 03:19:45 darkstar kernel: fuse init (API version 7.11)
Jun 11 03:19:45 darkstar kernel: EXT4 FS on hda1, internal journal on hda1:8
Jun 11 03:19:45 darkstar kernel: lp0: using parport0 (interrupt-driven).
Jun 11 03:19:45 darkstar kernel: lp0: console ready
Jun 11 03:19:48 darkstar logger: /etc/rc.d/rc.inet1: /sbin/ifconfig lo 127.0.0.1
Jun 11 03:19:48 darkstar logger: /etc/rc.d/rc.inet1: /sbin/route add -net 127.0.0.0 netmask 255.0.0.0 lo
Jun 11 03:19:50 darkstar logger: /etc/rc.d/rc.inet1: /sbin/ifconfig eth0 192.168.0.254 broadcast 192.168.0.255 netmask 255.255.255.0
Jun 11 03:19:50 darkstar kernel: eth0: link up
Jun 11 03:19:58 darkstar logger: /etc/rc.d/rc.inet1: /sbin/route add default gw 192.168.0.1 metric 1
Jun 11 03:20:01 darkstar kernel: NET: Registered protocol family 10
Jun 11 03:20:01 darkstar kernel: lo: Disabled Privacy Extensions
Jun 11 03:20:02 darkstar sshd[3031]: Server listening on 0.0.0.0 port 3322.
Jun 11 03:20:02 darkstar sshd[3031]: Server listening on :: port 3322.
Jun 11 03:20:03 darkstar acpid: starting up
Jun 11 03:20:03 darkstar acpid: 1 rule loaded
Jun 11 03:20:03 darkstar acpid: waiting for events: event logging is off
Jun 11 03:20:29 darkstar acpid: client connected from 3089[82:82]
Jun 11 03:20:29 darkstar acpid: 1 client rule loaded
Jun 11 03:20:35 darkstar /usr/sbin/gpm[3155]: *** info [startup.c(95)]:
Jun 11 03:20:35 darkstar /usr/sbin/gpm[3155]: Started gpm successfully. Entered daemon mode.
Jun 11 03:39:44 darkstar -- MARK --
Jun 11 03:59:45 darkstar -- MARK --
Jun 11 04:19:45 darkstar -- MARK --
Jun 11 04:39:45 darkstar -- MARK --
Jun 11 04:59:45 darkstar -- MARK --
Jun 11 10:22:25 darkstar sshd[3256]: Accepted publickey for astor from 192.168.0.102 port 1251 ssh2
Jun 11 10:30:11 darkstar kernel: ip_tables: (C) 2000-2006 Netfilter Core Team
Jun 11 10:59:45 darkstar -- MARK --
Jun 11 11:14:41 darkstar sshd[3375]: Accepted publickey for astor from 192.168.0.102 port 1358 ssh2
Открих че компютърът е рестартиран в 03:19ч. Това какво означава? Дали е спирал тока или се е инициирал рестарт от самия компютър? syslogd май инициира рестарта, защо? тук имам още един върпос това crash в изхора от last какво означава? проблем ли е някакъв? И май не се разбира по каква причина е изчезнал файла.
Титла: Re: rc.local ичезна?
Публикувано от: arda_kj в Jun 11, 2010, 14:32
Мирише ми на хакнат комп или поне опит за хакване. В този форум един от хората, които разбира най-добре от това е gate3way, дано да види темата и да каже какво точно му е на Слака. Трябва да дадеш малко повече инфо, за да се изясни картината: 1) За сървър ли се ползва този компютър? (Има нещо мязащо на ftp процес - ftpd) Какви услуги вървят на този компютър? 2) Провери какво е това нещо ftpd - процес или потребител; 3) Дай целия лог от изхода на "last", за да разберем кога точно се е появило това нещо ftpd. Дай направо изхода от "last -aFx". 4) Също може да дадеш изхода от - "lastb", за да видим дали е имало опити за bruteforce и т.н. 5) Също изхода от - "cat /var/log/syslog | grep -i ftpd" да видим активността на ftpd, както виждам от него е дошъл проблема. 6) Също не е зле да си наблюдаваш системата за кънекции и логнати потребители. Например наблюдавай изходите от следните две команди (ако искаш направо даже си направи скрипт да логва резултата на всеки 10сек., за да не ги пускаш ръчно постоянно, в случай, че не ти се кисне пред компа): Първата команда ти дава инфо за кънекциите, втората за логнатите потребители и какво правят. Май за сега това е достатъчно. Ако колегите се сещат нещо повече да помагат.
Титла: Re: rc.local ичезна?
Публикувано от: b2l в Jun 11, 2010, 14:37
Че аз до сега не съм трил rc.local файловете :D :D :D :D - нещо не схващам защо някой да го прави. Нито пък да reboot-ва?
Титла: Re: rc.local ичезна?
Публикувано от: Astor в Jun 11, 2010, 15:20
@arda_kj: #lastb
btmp begins Tue Jun 1 04:40:01 2010 root@astor:# last -ax
astor pts/0 Fri Jun 11 14:52 still logged in 192.168.0.102
astor ftpd3455 Fri Jun 11 14:17 gone - no logout 192.168.0.102
astor ftpd3454 Fri Jun 11 14:17 gone - no logout 192.168.0.102
astor ftpd3452 Fri Jun 11 14:13 gone - no logout 192.168.0.102
astor ftpd3451 Fri Jun 11 14:13 gone - no logout 192.168.0.102
astor pts/0 Fri Jun 11 11:55 - 12:10 (00:14) 192.168.0.102
astor ftpd3403 Fri Jun 11 11:30 gone - no logout 192.168.0.102
astor ftpd3402 Fri Jun 11 11:30 gone - no logout 192.168.0.102
astor ftpd3395 Fri Jun 11 11:20 gone - no logout 192.168.0.102
astor ftpd3394 Fri Jun 11 11:20 gone - no logout 192.168.0.102
astor pts/0 Fri Jun 11 11:14 - 11:40 (00:25) 192.168.0.102
astor ftpd3357 Fri Jun 11 10:35 gone - no logout 192.168.0.102
astor ftpd3356 Fri Jun 11 10:35 gone - no logout 192.168.0.102
astor ftpd3354 Fri Jun 11 10:35 gone - no logout 127.0.0.1
astor pts/0 Fri Jun 11 10:22 - 10:57 (00:35) 192.168.0.102
runlevel (to lvl 3) Fri Jun 11 03:19 - 15:08 (11:49) 2.6.29.6-smp
reboot system boot Fri Jun 11 03:19 (11:49) 2.6.29.6-smp
astor ftpd5262 Fri Jun 11 00:30 - crash (02:49) 88.80.5.234
astor ftpd5261 Fri Jun 11 00:30 - crash (02:49) 88.80.5.234
astor ftpd5259 Fri Jun 11 00:22 - crash (02:57) 88.80.5.234
astor ftpd5258 Fri Jun 11 00:22 - crash (02:57) 88.80.5.234
astor ftpd5250 Thu Jun 10 21:34 - crash (05:45) 88.80.5.234
astor ftpd5249 Thu Jun 10 21:34 - crash (05:45) 88.80.5.234
astor ftpd5242 Thu Jun 10 18:59 - crash (08:19) 88.80.5.234
astor ftpd5241 Thu Jun 10 18:59 - crash (08:19) 88.80.5.234
astor ftpd5232 Thu Jun 10 16:44 - crash (10:34) 192.168.0.102
astor ftpd5231 Thu Jun 10 16:44 - crash (10:34) 192.168.0.102
astor ftpd5230 Thu Jun 10 16:44 - crash (10:35) 192.168.0.102
astor ftpd5229 Thu Jun 10 16:44 - crash (10:35) 192.168.0.102
astor ftpd5215 Thu Jun 10 10:03 - crash (17:16) 192.168.0.102
astor ftpd5214 Thu Jun 10 10:03 - crash (17:16) 192.168.0.102
astor ftpd5211 Thu Jun 10 10:02 - crash (17:16) 192.168.0.102
astor ftpd5210 Thu Jun 10 10:02 - crash (17:16) 192.168.0.102
astor ftpd5203 Thu Jun 10 08:28 - crash (18:51) 88.80.5.234
astor ftpd5202 Thu Jun 10 08:28 - crash (18:51) 88.80.5.234
astor ftpd5117 Wed Jun 9 23:22 - crash (1+03:56) 88.80.5.234
astor ftpd5116 Wed Jun 9 23:22 - crash (1+03:56) 88.80.5.234
astor ftpd5115 Wed Jun 9 23:22 - crash (1+03:56) 88.80.5.234
astor ftpd5100 Wed Jun 9 17:35 - crash (1+09:44) 192.168.0.102
astor ftpd5099 Wed Jun 9 17:35 - crash (1+09:44) 192.168.0.102
astor ftpd5096 Wed Jun 9 17:34 - crash (1+09:45) 192.168.0.102
astor ftpd5095 Wed Jun 9 17:34 - crash (1+09:45) 192.168.0.102
astor ftpd5076 Wed Jun 9 09:32 - crash (1+17:47) 192.168.0.102
astor ftpd5075 Wed Jun 9 09:32 - crash (1+17:47) 192.168.0.102
astor ftpd5074 Wed Jun 9 09:32 - crash (1+17:47) 192.168.0.102
astor ftpd5073 Wed Jun 9 09:31 - crash (1+17:47) 192.168.0.102
astor ftpd5072 Wed Jun 9 09:31 - crash (1+17:47) 192.168.0.102
astor ftpd4987 Wed Jun 9 00:23 - crash (2+02:56) 88.80.5.234
astor ftpd4986 Wed Jun 9 00:23 - crash (2+02:56) 88.80.5.234
astor pts/0 Tue Jun 8 15:41 - 15:41 (00:00) 192.168.0.102
astor ftpd4943 Tue Jun 8 13:21 - crash (2+13:58) 192.168.0.102
astor ftpd4942 Tue Jun 8 13:21 - crash (2+13:58) 192.168.0.102
astor ftpd4940 Tue Jun 8 13:20 - crash (2+13:58) 192.168.0.102
astor ftpd4939 Tue Jun 8 13:18 - crash (2+14:00) 192.168.0.102
astor ftpd4938 Tue Jun 8 13:16 - crash (2+14:02) 192.168.0.102
astor ftpd4937 Tue Jun 8 13:16 - crash (2+14:02) 192.168.0.102
astor pts/0 Tue Jun 8 13:04 - 13:05 (00:00) 192.168.0.102
astor ftpd4554 Sat Jun 5 07:40 - crash (5+19:38) 81.161.243.110
astor ftpd4553 Sat Jun 5 07:40 - crash (5+19:38) 81.161.243.110
astor ftpd4472 Sat Jun 5 00:24 - crash (6+02:54) 88.80.5.234
astor ftpd4471 Sat Jun 5 00:24 - crash (6+02:54) 88.80.5.234
astor ftpd4465 Sat Jun 5 00:00 - crash (6+03:19) 88.80.5.234
astor ftpd4222 Wed Jun 2 16:27 - crash (8+10:52) 193.68.2.94
astor ftpd4221 Wed Jun 2 16:27 - crash (8+10:52) 193.68.2.94 На компютъра има ftp сървър стартиран и ftpd е процесът на proftp сървърът, стартиран от inetd. До сега не е имало проблеми с ftp-то...и не знам защо е този коментар crash. IP адресът 88.80.5.234 е моят от вкъщи, а 192.168.0.102 е пак моя но когато съм се вързал към локалната мрежа в офиса и достъпвам ftp-то. Има варианти да съм го достъпвал и от други места, или някой мой колега също да е влизал в него. В cat /var/log/syslog няма споменато изобщо ftpd. Това животно syslogd ми е рестартирало компютъра, и то преиодично, не е само веднъж на 11.06. А кога точно е изчезнал файлът е мистерия и защо? Поне да го направя такъв че повече да не може да се изтрива така мистериозно.
Титла: Re: rc.local ичезна?
Публикувано от: laskov в Jun 11, 2010, 15:34
Това животно syslogd ми е рестартирало компютъра, и то преиодично, не е само веднъж на 11.06. Това животно записва в лога, че компютърът се рестартира. То не може да го рестартира.
Титла: Re: rc.local ичезна?
Публикувано от: arda_kj в Jun 11, 2010, 16:13
@Astro - хипотезата за хакване май отпада, след твоите обяснения мисля, че от тази гледан точка компа ти е наред (погледни ако искаш и /var/auth.log за нещо съмнително). За да се разбере обаче какво точно му има трябва яко мониторинг и ровене в логовете за старанни неща и/или грешки, които могат да помогнат да се разбере каква е причината за изчезването на rc.local. Провери си в логовете на ftp-то защо точно е крашнал, очевадно имаш някакъв проблем с ftp-то. Както каза колегата преди мен syslogd няма как да ти рестартира компа, той само логва инфо в /var/log/syslog. Направи си нов rc.local и му задай флаговете така, че само root да има право да пише по него, а другите да могат само да четат, например нещо от типа: Това трябва да даде право на root да чете, пише и изпълнява файл, а на всички останали само да четат и изпълняват файла. След това просто следиш какво става, препоръчителни логове за гледане са (при мен в Убунту са така именувани, при теб може да има разлика): 1) /var/log/kern.log 2) /var/log/syslog 3) /var/log/messages Ако проблема пак се повтори значи не е било нещо инцидентно и трябва сериозен мониторинг. Ако искаш си пусни и check на файловата система, просто да се увериш, че проблема не е от нея. Ако искаш давай горните логове да гледаме и ако може да идентифицираме проблема.
Титла: Re: rc.local ичезна?
Публикувано от: runtime в Jun 11, 2010, 16:24
Малко тъп въпрос ама провери ли в lost+found дали случайно ти го няма файла?
Титла: Re: rc.local ичезна?
Публикувано от: Astor в Jun 11, 2010, 17:12
Благодаря ви за отговорите! директорията lost+found e празна. Относно /var/log/syslog имам следните притеснения. Имам общо 5 файла syslog.X, от които syslog.1 и syslog.3 са празни. Имам големи интервали от цели дни в които няма записи. Ето и самия /var/log/syslog: skipping 3 old session files
reading /var/log/syslog
Jun 11 03:19:45 darkstar kernel: i2c_core: exports duplicate symbol i2c_smbus_xfer (owned by kernel)
Jun 11 03:19:45 darkstar kernel: ACPI: I/O resource piix4_smbus [0x1040-0x1047] conflicts with ACPI region SMB_ [0x1040-0x104
b]
Jun 11 03:19:45 darkstar kernel: piix4_smbus 0000:00:07.3: Host SMBus controller not enabled!
Jun 11 10:35:24 darkstar kernel: nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
Jun 11 10:35:24 darkstar kernel: CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
Jun 11 10:35:24 darkstar kernel: nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
Jun 11 10:35:24 darkstar kernel: sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
Jun 11 16:27:07 darkstar kernel: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
Jun 11 16:27:07 darkstar kernel: GFS2 (built Aug 17 2009 00:51:32) installed
Jun 11 16:27:07 darkstar kernel: Compaq SMART2 Driver (v 2.6.0)
Jun 11 16:27:07 darkstar kernel: scsi: <fdomain> Detection failed (no card)
Jun 11 16:27:07 darkstar kernel: Emulex LightPulse Fibre Channel SCSI driver 8.3.0
Jun 11 16:27:07 darkstar kernel: Copyright(c) 2004-2008 Emulex. All rights reserved.
Jun 11 16:27:07 darkstar kernel: Failed initialization of WD-7000 SCSI card!
Jun 11 16:27:07 darkstar kernel: GDT-HA: Storage RAID Controller Driver. Version: 3.05
Jun 11 16:27:07 darkstar kernel: 3ware Storage Controller device driver for Linux v1.26.02.002.
Jun 11 16:27:07 darkstar kernel: 3ware 9000 Storage Controller device driver for Linux v2.26.02.011.
Jun 11 16:27:07 darkstar kernel: Driver 'st' needs updating - please use bus_type methods
Jun 11 16:27:07 darkstar kernel: Driver 'sd' needs updating - please use bus_type methods
Jun 11 16:27:07 darkstar kernel: Driver 'sr' needs updating - please use bus_type methods
Jun 11 16:27:07 darkstar kernel: raid6: int32x1 1105 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: int32x2 1355 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: int32x4 1714 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: int32x8 1031 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: mmxx1 3742 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: mmxx2 4289 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: sse1x1 2207 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: sse1x2 4148 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: sse2x1 4722 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: sse2x2 5101 MB/s
Jun 11 16:27:07 darkstar kernel: raid6: using algorithm sse2x2 (5101 MB/s)
Jun 11 16:27:07 darkstar kernel: EXT3-fs: hda1: couldn't mount because of unsupported optional features (240).
Jun 11 16:27:07 darkstar kernel: EXT2-fs: hda1: couldn't mount because of unsupported optional features (240).
Jun 11 16:27:07 darkstar kernel: VFS: Mounted root (ext4 filesystem) readonly on device 3:1.
Jun 11 16:27:07 darkstar kernel: i2c_core: exports duplicate symbol i2c_smbus_xfer (owned by kernel)
Jun 11 16:27:07 darkstar kernel: ACPI: I/O resource piix4_smbus [0x1040-0x1047] conflicts with ACPI region SMB_ [0x1040-0x104
b]
Jun 11 16:27:07 darkstar kernel: piix4_smbus 0000:00:07.3: Host SMBus controller not enabled!
Jun 11 16:27:40 darkstar kernel: nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
Jun 11 16:27:40 darkstar kernel: CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
Jun 11 16:27:40 darkstar kernel: nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
Jun 11 16:27:40 darkstar kernel: sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
Относно /var/log/messages съм го показал в предния пост. И там имам известни съмнения. Защо на 6.06 в 4:40ч. има следния ред: Jun 6 04:40:02 darkstar syslogd 1.4.1: restart.
след който няма никакви други записи, а при рестарт трябва да се логват и още ~100 реда. Например при рестарт в Jun 11 03:19:45 darkstar syslogd 1.4.1: restart.
има след него други редове. И идеята ми е коя е причината за рестарта, дали от спиране на ток или е подаден сигнал за рестарт от някой процес? A файлът /var/log/kern.log не намирам :(
Титла: Re: rc.local ичезна?
Публикувано от: laskov в Jun 11, 2010, 17:34
Относно /var/log/messages съм го показал в предния пост.
И там имам известни съмнения. Защо на 6.06 в 4:40ч. има следния ред:
Jun 6 04:40:02 darkstar syslogd 1.4.1: restart.
след който няма никакви други записи, а при рестарт трябва да се логват и още ~100 реда. Например при рестарт в
Jun 11 03:19:45 darkstar syslogd 1.4.1: restart.
има след него други редове. Първото не е рестарт на компютъра, а е планирана в /etc/cron.daily logrotate задача. Всичко, което е в тази дир се изпълнява от cron всеки ден в 4:40. logrotate е конфигуриран в /etc/logrotate.conf всяка неделя да архивира messages, maillog, syslog, ..., след което да рестартира демона syslog (само него). Вторият рестарт на 11.06 е рестарт на компютъра. logrotate архивира лог файловете като им слага по един номер отзад и по желание може и да ги компресира. Архивира по същия начин и празните файлове. Но няма гаранция дали някой не ги е изпразнил нарочно :( A файлът /var/log/kern.log не намирам Такъв файл в slackware няма.
Титла: Re: rc.local ичезна?
Публикувано от: Astor в Jun 15, 2010, 09:52
Благодаря ви на всички за отговорите, но имам и последно ъпросче което се появи преди два дни. Сега след lastb резултатът от командата е следния: ***** ssh:notty 192.168.0.102 Fri Jun 11 17:12 - 17:12 (00:00)
btmp begins Fri Jun 11 17:12:08 2010
Какво е това ssh:notty? и защо се е записало? Багодаря ви предварително
Титла: Re: rc.local ичезна?
Публикувано от: b2l в Jun 15, 2010, 09:58
Сигурно е някой бот, който просто проверява дали ще се логне със стандартните имена и пароли.
Титла: Re: rc.local ичезна?
Публикувано от: laskov в Jun 15, 2010, 09:59
Защото си сгрешил паролата, като си я въвеждал при влизането с ssh
|