Files corrupt on FTP Server

randaddyz · 07-14-2006, 05:21 PM

I have inherited a FTP server running Linux 2.4.22 (tty1). I am quite new to Linux. My question is that this server for the last 5 years has been running non stop without a hiccup but... Someone uploaded a file to it that has locked all directories. I am trying to go in and delete the file but I cannot find it. When try the find command and type the name it just returns to the next line without anything. Is there some search command that I can search that will return anything by that file name or a command that will search the whole drive and delete any file that matches the criteria?

I really would like to get this running again.

Thanks in advance!!!!

unSpawn · 07-14-2006, 06:56 PM

Hello and welcome to LQ.

Kernel 2.4.22 was released in 2003. Doesn't spell much good wrt keeping updated. If you have any doubt more things could be wrong (breach of security) I suggest saving listings of open files (lsof -n), processes (ps axwwwe), network connections (netstat -an) and users (w; who; last) and then pull plug on the network. If you can't do that (box in remote location) then you could block inbound traffic at the router it's behind or raise the firewall to only allow traffic to/from your management IP or shut down daemons you don't need for accessing the box (you only need ssh).

My question is that this server for the last 5 years has been running non stop without a hiccup but... Someone uploaded a file to it that has locked all directories.
What exactly do you mean by "locked"? Not being able to list or write files?
Does it return an error message when you try to list or write?
What error messages does the FTP service log show?
What error messages does syslog show?

I am trying to go in and delete the file but I cannot find it.
When did the upload occur (see FTP daemon logfile) or when did someone first notice?
If you have an aproximate date you could try "find / -ctime n" where n is the amount of days ago.

When try the find command and type the name it just returns to the next line without anything.
So you know the name? What's the file called?

randaddyz · 07-18-2006, 06:17 PM

Thanks for replying.

It was one of our users that tried to back up his pst file from outlook. The file was 1.8GB. When I say it locked I mean that when we try to access any files or folders we the message that unaccessable. So I can see the files but cannot list them. I have to disconnect the client. The file is called CMPST.

i hope this helps!!!

Randaddy

Quote:

Originally Posted by unSpawn

Hello and welcome to LQ.

Kernel 2.4.22 was released in 2003. Doesn't spell much good wrt keeping updated. If you have any doubt more things could be wrong (breach of security) I suggest saving listings of open files (lsof -n), processes (ps axwwwe), network connections (netstat -an) and users (w; who; last) and then pull plug on the network. If you can't do that (box in remote location) then you could block inbound traffic at the router it's behind or raise the firewall to only allow traffic to/from your management IP or shut down daemons you don't need for accessing the box (you only need ssh).

My question is that this server for the last 5 years has been running non stop without a hiccup but... Someone uploaded a file to it that has locked all directories.
What exactly do you mean by "locked"? Not being able to list or write files?
Does it return an error message when you try to list or write?
What error messages does the FTP service log show?
What error messages does syslog show?

[i]I am trying to go in and delete the file but I cannot find it.[i]
When did the upload occur (see FTP daemon logfile) or when did someone first notice?
If you have an aproximate date you could try "find / -ctime n" where n is the amount of days ago.

When try the find command and type the name it just returns to the next line without anything.
So you know the name? What's the file called?

unSpawn · 07-18-2006, 07:19 PM

Log in and run lsof -n | grep -i for the filename to see if the FTP daemon or any other app has got the file opened. Then stop or kill that app and then try to delete the file. If that doesn't work reboot the box with a Live CD and then delete the file.