LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (http://www.linuxquestions.org/questions/linux-software-2/)
-   -   Bus error (http://www.linuxquestions.org/questions/linux-software-2/bus-error-339532/)

bratch 07-03-2005 03:24 AM

Bus error
 
I'm currently having trouble running any commands on my server.

When I ssh in, running top or ps gives me "Bus error", and running df gives me a seg fault.

This has only started happening recently.

Ideally I'd like to solve this without a reboot, by the way.

Edit:
Uh oh - I found this in /root:
http://www.bratch.co.uk/coven/sslmass2.gz

(That's the server domain by the way)

I also couldn't copy that file using cp, had to use an upload script. cp seg faults.

Also it is running kernel 2.4.26 and apache Apache 1.3.31 with OpenSSL 0.9.7d.

Half_Elf 07-04-2005 01:23 PM

Look like a real deep and bad library problem. Have you tried updating (you are running Gentoo right?) your system.
When did this problem started, was it after an update?

Btw, according to versions you gave us, your system is out-dated, have you considered you might have been rooted?

bratch 07-04-2005 02:27 PM

I didn't do anything to cause it, but the appearance of the file in /root suggests that it was an intruder that caused it, not me.

It's running Slackware 10.0, and yes it was outdated - I think this may be why it has happened, ie. an unpatched security flaw.

Half_Elf 07-04-2005 03:00 PM

errrrk you probably been rooted (read : hacked) then.
Your SSL version was (is) pretty out-dated the attacker maybe exploited this to get in.

Ok, so the first thing to do is to turn off the network connection now. Your computer is probably already used as a spam send plateform/warez website/DDOS zombie.
Second, go get some live-cd distro ( I recommend knoppix but anything will do it) and boot from it then mount your slackware partition. You might want to search for evidences ( any "proof" someone breaked in) but don't take there is no problem if you don't find any. In _ANY_ case my guess would be backup/format/reinstall/update . I don't think you want to become the spam king or to be used to flood ebay, so if you are any suspicious that you have been hacked, you better reinstall and fix up the new system.

bratch 07-04-2005 03:07 PM

Looks like this is the perfect oppertunity to migrate my final machine (that server) to Gentoo.

Thanks for advice - I thought this'd be the case but wanted a second oppinion.

Far easier to keep up to date with Gentoo too, so hopefully won't be caught out by not patching ot the future.

Half_Elf 07-04-2005 03:53 PM

yup, I switched from Slackware to Gentoo because it was way easier to update Gentoo... Still, the KISS ( Keep It Simple Stupid) philosophy of Slackware seize me, some Gentoo "advanced" feature are just bugging me (example: why does my hostname has to be setted in /etc/conf.d/hostname now, considering all *nix flavors put it in /etc/hostname since twenty years at least??).

bratch 07-04-2005 03:56 PM

I've just noticed that myself about Gentoo - I took a bit of a gamble and deleted /etc/domainname after filling in the new one... It wasn't clear if you're meant to though.


All times are GMT -5. The time now is 02:20 PM.