strange behaviour when bash starts

Y0jiMb0 · 07-06-2004, 03:01 AM

Hello everybody!
since yesterday I got a puzzle with new sessions of bash (I noticed first in Konsole but the same happens when I go to tty6 and I log in there).
When the session begins I get a lot of garbage like...

Code:

dircolors: Unknown keyword
dircolors: Unknown keyword ë¬;ãÞÝiµ
dircolors: Unknown keyword ÅCÐÒÉô*c
dircolors: Unknown keyword !ÂÞ.À.Àú
dircolors: Unknown keyword ÔÉjôÃýaQõÓÃ_Sµ*ÊoÎ^È$à¬7¯½ÅA2*±ÅÅÐV&V]0RW4va¢WY+u4ÂT7OlM
dircolors: Unknown keyword t/J<òh+Í÷h¬¦É´²ðÊü¹¡ºÝCÖ·Úü@Û%lÅJEfsÛÃ)÷6æ3Q2Ç'1°¤VjVBy
dircolors: Unknown keyword 6Wî4Ev¦»R©1Ø
dircolors: Unknown keyword N ">§?`ÅÐ·<ßÀ<ÂúÄA>éBeóÛ[.
dircolors: Unknown keyword §
dircolors: Unknown keyword ÒEvUZä2
dircolors: Unknown keyword ÄNîªº9ï²³
dircolors: Unknown keyword kj)µ¥3åÚ¦²òÊåuu¥µIØÐ[Im1FªÎ~\ÈÔÌÓjU®,d_¢¦
dircolors: Unknown keyword AÊÌ*Å7uB-*¡òu▒©³Ë
dircolors: Unknown keyword [UzÄÐ³ÛÛÕGXÞ¶]°vDSëm7V´Ü¨ëw=¨e#äiZë▒MQv
dircolors: Unknown keyword üÀ%)X¢´@
dircolors: Unknown keyword }Ð>
dircolors: Unknown keyword ÊeQ®q}?Lãú8.¬qgåÜèlÝ¯HÊtj-'Ü`¾`eÌY¡_;´3÷ÄÒ
dircolors: Unknown keyword ¬▒¥<m·¼ïE}ß_>ÂË¾·x<+?¯Ykû ¾t3·/éý}É3}4rúãÂ})+çf®VýD£}ëk¹D*cNýS$3ãªhÂíùµ£94üUò-P_;¤Ãõ*63?* W
dircolors: Unknown keyword ¨Gµz§Q«äUA½÷%dNñà,ËÐ
...
blah blah blah
...
Èÿrcolors: Unknown keyword ó¿^=L:ÿ
-bash: eval: line 1: syntax error near unexpected token `)'
-bash: eval: line 1: `LS_COLORS='*j=û4aW*¼▒ÎÀÖ\ãX.~&O¹-ynÊQéI£¹:*.x@Át~¥"@éFÉÎÇ²oõÅ¦]D+Î=:*d=vHE AJõàSª+°'D" It+^_¹ç+¬naé¢¤V▒âiI$´½¥ kíl!'[4M¯u´ãÓ0F+çl°å§g¸Ö@;"§°Ê)rbÒù,àµP
                                                              u
Ùå!ªÃa{|)                                                      G3
         Å`6±×`OÜù,¨▒]á×XGºÁ-6E%1}5!hfU0åÌC\=1Ä \(6BÍ:*.ôï¡â¸-ÚÚp¼øU2ï££=´eüÑX{Üå³ëe¼zSÛ-²1qÈúÆK»qþ¬¡Á/&´åç¢Û>4LáU>eÔ±Ì¬ð_\:óüþ1Nx&½**\$¼+*N\:§üqJÒ±\=ÄWSNHXe°ô\=C/m}©ºt

...
blah blah
...

*▒\:*¿ømßÔÍb0k¾eÑðç·jµñÝÏo×T=³¶îÊ*l«[vÅPÈZSY6^ÁåBUo®²+Øh¯Q×]ÃùXÄæÛ}vOã½t}ñ Hqf▒▒þí6¼îïXøé~íæWotÈù;kDYÒæP}£oç'(~¥(ÖîQ^·+¿'Ó&ËGüC{{á¼qàÈ$þÇµÝ¤¶uïjÛö▒þÕ?Ô6âlFö´§ëº)¦*½·ÜóØÉ:'; export LS_COLORS; LS_OPTIONS=' --color=never'; export LS_OPTIONS; alias ls='/usr/bin/ls $LS_OPTIONS'; alias dir='/usr/bin/ls $LS_OPTIONS --format=vertical'; alias vdir='/usr/bin/ls $LS_OPTIONS --format=long'; alias d=dir; alias v=vdir;'

[fortune output (last event)]

yojimbo@man:~$ 1;1;112;112;1;0x1;1;112;112;1;0x1;1;112;112;1;0x1;1;112;112;1;0x1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;2c1;2c1;2c1;1;112;112;1;0x1;2c1;1;112;112;1;0x1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;1;112;112;1;0x1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c

Now, the set of environment variables is much smaller than days ago and, for instance, I cannot see the nice colors when I do "ls".

My main worry is that I didn't change (to my knoledge) anything, and I don't understand what could happen.

How can I solve this mess?
TIA

Regards

Crashed_Again · 07-06-2004, 02:33 PM

Check the .bashrc file in your home directory. It looks like it got corrupted somehow.

Y0jiMb0 · 07-06-2004, 03:32 PM

Quote:

Check the .bashrc file in your home directory. It looks like it got corrupted somehow.

Thanks, Crashed_Again for the suggestion, but there is no ".bashrc" in my box; perhaps I had to tell that before: I'm under salckware, if I'm not wrong slack doesn't come with such file by default. Anyway I think that the relevant file is "/etc/profile" or any in "/etc/profile.d/", but I don't know which one is, what to do with it and, of course, why did it get corrupted.
BTW, this is the content of "/etc/profile.d/" (just in case...)

Code:

-rwxr-xr-x    1 root     root          164 Mar 14  2003 bsd-games-login-fortune.csh
-rwxr-xr-x    1 root     root          141 Mar 14  2003 bsd-games-login-fortune.sh
-rwxr-xr-x    1 root     root           32 Jan 11  2003 gtk+.csh
-rwxr-xr-x    1 root     root           43 Jan 11  2003 gtk+.sh
-rwxr-xr-x    1 root     root          102 Oct 31  2000 htdig.csh
-rwxr-xr-x    1 root     root          101 Oct 31  2000 htdig.sh
-rwxr-xr-x    1 root     root          146 Sep 12  2003 j2sdk.csh
-rwxr-xr-x    1 root     root          145 Sep 12  2003 j2sdk.sh
-rwxr-xr-x    1 root     root          176 Sep 15  2003 kde.csh
-rwxr-xr-x    1 root     root           85 Sep 15  2003 kde.sh
-rwxr-xr-x    1 root     root          227 Mar 10  2003 lang.csh
-rwxr-xr-x    1 root     root          225 Mar 10  2003 lang.sh
-rwxr-xr-x    1 root     root           51 May 14 23:51 mc.csh
-rwxr-xr-x    1 root     root           45 May 14 23:51 mc.sh
-rwxr-xr-x    1 root     root           31 Jan 16  2003 metacity.csh
-rwxr-xr-x    1 root     root           31 Jan 16  2003 metacity.sh
-rwxr-xr-x    1 root     root          443 Sep 14  2003 qt.csh
-rwxr-xr-x    1 root     root          396 Sep 14  2003 qt.sh
-rwxr-xr-x    1 root     root           50 Oct 22  2002 t1lib.csh
-rwxr-xr-x    1 root     root           63 Oct 22  2002 t1lib.sh
-rwxr-xr-x    1 root     root          134 Apr 24  2000 tetex.csh
-rwxr-xr-x    1 root     root          118 Apr 24  2000 tetex.sh

Any additional idea?

Regards

Crashed_Again · 07-07-2004, 12:26 AM

And what do the contents of /etc/profile and /etc/bashrc(if it exists) look like?

Y0jiMb0 · 07-07-2004, 01:24 AM

Thanks again, Crashed_Again!

Here is my "/etc/profile" (there is no "/etc/bashrc")

Code:

# /etc/profile: This file contains system-wide defaults used by
# all Bourne (and related) shells.

# Set the values for some environment variables:
export MINICOM="-c on"
export MANPATH=/usr/local/man:/usr/man:/usr/X11R6/man
export HOSTNAME="`cat /etc/HOSTNAME`"
export LESSOPEN="|lesspipe.sh %s"
export LESS="-M"

# If the user doesn't have a .inputrc, use the one in /etc.
if [ ! -r "$HOME/.inputrc" ]; then
  export INPUTRC=/etc/inputrc
fi

# Set the default system $PATH:
PATH="/usr/local/bin:/usr/bin:/bin:/usr/X11R6/bin:/usr/games"

# For root users, ensure that /usr/local/sbin, /usr/sbin, and /sbin are in
# the $PATH.  Some means of connection don't add these by default (sshd comes
# to mind).
if [ "`id -u`" = "0" ]; then
  echo $PATH | grep /usr/local/sbin 1> /dev/null 2> /dev/null
  if [ ! $? = 0 ]; then
    PATH=/usr/local/sbin:/usr/sbin:/sbin:$PATH
  fi
fi

# I had problems using 'eval tset' instead of 'TERM=', but you might want to
# try it anyway. I think with the right /etc/termcap it would work great.
# eval `tset -sQ "$TERM"`
if [ "$TERM" = "" -o "$TERM" = "unknown" ]; then
 TERM=linux
fi

# Set ksh93 visual editing mode:
if [ "$SHELL" = "/bin/ksh" ]; then
  VISUAL=emacs
#  VISUAL=gmacs
#  VISUAL=vi
fi

# Set a default shell prompt:
#PS1='`hostname`:`pwd`# '
if [ "$SHELL" = "/bin/pdksh" ]; then
 PS1='! $ '
elif [ "$SHELL" = "/bin/ksh" ]; then
 PS1='! ${PWD/#$HOME/~}$ '
elif [ "$SHELL" = "/bin/zsh" ]; then
 PS1='%n@%m:%~%# '
elif [ "$SHELL" = "/bin/ash" ]; then
 PS1='$ '
else
 PS1='\u@\h:\w\$ '
fi
PS2='> '
export PATH DISPLAY LESS TERM PS1 PS2

# Default umask.  A umask of 022 prevents new files from being created group
# and world writable.
umask 022

# Set up the LS_COLORS and LS_OPTIONS environment variables for color ls:
if [ "$SHELL" = "/bin/zsh" ]; then
 eval `dircolors -z`
elif [ "$SHELL" = "/bin/ash" ]; then
 eval `dircolors -s`
else
 eval `dircolors -b`
fi

# Notify user of incoming mail.  This can be overridden in the user's
# local startup file (~/.bash.login or whatever, depending on the shell)
if [ -x /usr/bin/biff ]; then
 biff y
fi

# Append any additional sh scripts found in /etc/profile.d/:
for file in /etc/profile.d/*.sh ; do
  if [ -x $file ]; then
    . $file
  fi
done

# For non-root users, add the current directory to the search path:
if [ ! "`id -u`" = "0" ]; then
 PATH="$PATH:."
fi

However I do believe that the problem is the command "dircolors"; I have tried "dircolors -b" and got the same garbage as I told before.
One (very) interesting point is that the file "/etc/DIR_COLORS" (where configuration of "dir_colors" lives) was changed monday (just the day the strange behaviour began):

Code:

-rw-r--r--    1 root     root         4.9M Jul  5 10:43 /etc/DIR_COLORS

it is pretty big, should it be so big?
How can I edit it? It looks coded, but it must be plain text, according to its manpage (man 5 dir_colors), mustn't it?
I would say that for some reason the "/etc/DIR_COLORS" was overwritten, but to be honest I didn't realized of the presence of such file until now, so I'm not sure about this.

Moreover, I noticed that every file in "/etc/profile.d/" is executed and changes take effect, but the environment variable PATH doesn't change at all. I bet this is related to this other issue, but how?

Regards.

bulliver · 07-07-2004, 03:27 PM

Looks like the file is corrupted. Mine is < 3k and is plain text. I would suggest replacing it. The better question is why the file was changed...you say you didn't do it yourself? Was someone messing with your box?

If you can't get an uncorrupted DIR_COLORS then I spose I could post mine here...

Y0jiMb0 · 07-08-2004, 04:22 AM

Thanks bulliver!
That's what I did, I replaced the corrupted "/etc/DIR_COLORS" with a good one; I got one from the last backup I did (fortunately I use to back up the "/etc" directory as well

)
As I told before, I didn't even touch the "/etc/DIR_COLORS", and I'm quite sure that nobody else did it (unless a thief came into my home and instead of robbing something he decided to corrupt my /etc/DIR_COLORS file

)

As soon as I put a good DIR_COLORS file into my system and I restarted bash, everything worked again like a charm, so the key point now is, how could this file get corrupted?
From my paranoiac side I'd say that some cracker did it "for me"; but after taking a quick look to the rest of the system I didn't noticed any remarkable event, so I don't understand why should someone be so stealthy entering and afterwards be so noisy, but who knows...

Any sensible explanation? I feel now a bit insecure

Regards

bulliver · 07-08-2004, 05:00 AM

I don't know what to tell you, going from a plain text file to 4.9MB of garbage is a little suspect. Is anything else amiss? I don't want to alarm you but if not a cracker, I don't know how else your file could get corrupted like that.

I would recommend going very closely over your logs and look for any sort of login that you know you did not do....

Did you keep a copy of the corrupted file?? Might be interesting to look at with a hex editor.

Y0jiMb0 · 07-09-2004, 06:29 AM

Hi!
well, I was looking again at the logs. Last post I didn't mention one curious thing I noticed, but may be important: the /var/log/syslog* set of files have gaps jumping some days, even one file is totally empty. I use to keep the computer on continuosly, and perhaps that could be the reason why there are gaps in my syslogs. However I didn't realize those gaps before.
Appart from this nothing special is in my logs (that seems to me), but I'll keep an eye on them...
BTW, I of course keep the corrupted file, I edited with KHexEdit and I cannot see anything remarkable in it.

Best regards