Hi,
If some files are delete or corruption from redhat system such as /bin/bash, /bin/mount then how can I find these file belongs to what RPM.
If I have all Redhat RPM cds.

Thanks

Find out what package a file belongs to i.e. find what package owns the file--

example command :- rpm -qf /bin/bash

Now u can install the package.

you can install the package with the command.


rpm -ivh package name

On that machine you can verify the installation with 'rpm -qVa': any missing parts will show up with the "missing" tag. Or query the RPM database for a particular file: 'rpm -qf /bin/bash' on another machine (only works if the file exists and is known to the RPMDB).

* Also note that if this corruption or deletion is collateral damage from a breach of security, then restoring binaries is *not* the right approach.

Thanks.

unSpawn when I run 'rpm -qVa' then I see missing flag. But I also got different flag too. what is the flag for corrupted file.

The "5" for MD5sum mismatch.

well my /bin/mount file not working in rescue mode. mount command giving list like ls command. when I run rpm -qf /bin/mount then it tell package:
util-linux-2.13-0.44.el5

here is the result of rpm -qaV:
S.5....T c /etc/xml/catalog
.M...... /misc
Unsatisfied dependencies for firstboot-1.4.27.2-1.el5.noarch: metacity
.M...... /dev
SM5....T c /etc/sysconfig/iptables-config
..5....T c /etc/anacrontab
....L... c /etc/pam.d/system-auth
.M...... c /etc/cups/classes.conf
.......T c /etc/mail/sendmail.cf
S.5....T c /var/log/mail/statistics
S.5....T c /etc/sysconfig/system-config-securitylevel
.......T c /etc/kdump.conf
Unsatisfied dependencies for control-center-2.16.0-14.el5.i386: libmetacity-private.so.0
..5....T c /etc/printcap
.M.....T /bin/bash
..5....T c /etc/pki/nssdb/secmod.db
S.5....T c /etc/crontab
..5....T c /etc/inittab
.......T c /etc/audit/auditd.conf
SM5....T /bin/mount

I am unable to understand all these above flag. How can I find /bin/mount is wrong one.

You could use your distro's installer CD in rescue mode.


This could explain mount problems as it shows /bin/mount and /bin/bash have "M" or changed mode: both should have octal mode "0755".


See 'man rpm' under "verify options".


Could you tell us what caused all of this?

Originally Posted by waji
.M...... /misc
.M...... /dev
.M.....T /bin/bash
SM5....T /bin/mount


well if we take line from above for example

SM5.....T /bin/mount


S = File size mismatch

M = Mode (diffrent permission and file type)

5 = MD5 checksum wrong

T = File modification time mismatch

hope it will help.

thanks

UnSpawn > during playing all these took place. Now I saw "man rpm" on different system cuz in rescue 'man command' not working, only rpm --help in working.

Shahz thanks for your reply.
All files are look ok. except /bin/mount. I don't why others file showing Size and MD5 sum error. Could you tell me what is 'c' indicating before absolute path? Other then /bin/mount
Such as

..5....T c /etc/inittab
.......T c /etc/audit/auditd.conf

C = configruation file flag


thanks
shahz

Ah. OK. RPM allows you to restore permissions from the database for each affected package. The easiest way is to use 'rpm --setperms' (if that doesn't work you can -dump the database and script it from there but let's try this first). Automating it all you get: