LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Funny file crontab.vlsrut (https://www.linuxquestions.org/questions/linux-security-4/funny-file-crontab-vlsrut-4175485770/)

newbie14 11-24-2013 08:41 PM

Funny file crontab.vlsrut
 
I saw this file crontab.vlsrut in my /tmp with date 1/1/1970. I tried to google about it could not find. Any idea what is this file ?

unSpawn 11-25-2013 01:40 AM

Run 'stat' on the file, then 'strings -an1' and post the output.

newbie14 11-25-2013 05:58 AM

Dear Unspawn,
Below is the results you required.

Quote:

stat crontab.vlSrUt
File: `crontab.vlSrUt'
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: fd00h/64768d Inode: 1703944 Links: 1
Access: (0600/-rw-------) Uid: ( 500/ myuser) Gid: ( 500/ myuser)
Access: 2013-11-25 10:31:14.493986261 +0800
Modify: 1970-01-01 07:30:00.000000000 +0730
Change: 2013-05-18 18:06:54.499722156 +0800
strings -an1 crontab.vlSrUt gives me empty as I check the file is empty. I also checked crontab -e under this myuser is empty too and even after sudo -i is empty.

unSpawn 11-25-2013 12:00 PM

I confirm the temporary crontab file, as you would edit it via 'crontab -e', has a mtime of 1970. Probably broke off the edit so the temporary file remains. As it's empty you could delete it or it should be removed by 'tmpwatch' if installed and if so configured.

sundialsvcs 11-25-2013 01:01 PM

Agree. Many apps will generate files with a "temporary name," sometimes adding a random suffix (e.g. "vlsrut" could be a random string) because the temporary-files area in Linux is usually global. If the program dies, the file might be left behind. Nothing in this scenario, absent some other indication, is setting off warning-bells with me so far.

newbie14 11-25-2013 08:24 PM

Dear Unspawn,
Thank you for the confirmation was kind of worried because I google and could not fine any information on the file extension. IS tmpwatch an internal centos programme or should I install it? So it means that I have have started the crontab -e and just shut if off half way so this the cause of it can I confirm that?

newbie14 11-25-2013 08:26 PM

Dear Sundialcvs,
Thank you for the input because I could not google on the file extension got me worried. What do you mean by temporary-files area in Linux is usually global ?

unSpawn 11-26-2013 03:48 PM

Quote:

Originally Posted by newbie14 (Post 5070620)
IS tmpwatch an internal centos programme or should I install it?

Next time do make an effort please:
Code:

apropos tmpwatch || yum info tmpwatch

Quote:

Originally Posted by newbie14 (Post 5070620)
So it means that I have have started the crontab -e and just shut if off half way so this the cause of it can I confirm that?

It may be, yes.

newbie14 11-26-2013 08:44 PM

Dear Unspawn,
Sorry for that I am already googling it for some information it. I kind of learning a lots of new stuff and agree with what you told me earlier that security is an on going thing.


All times are GMT -5. The time now is 01:41 PM.