How to stop fork_bomb script run by user without using killall command

sanjay87 · 05-26-2012, 08:30 AM

Hi All,

Today i attended one of any interveiw ,One of the interveiwer asked regarding how to stop fork_bomb script run by user without using

killall -9 scriptname

can anyone help me how to stop a script running by a user without using a killall command.

Quote:

2 question. once of the important server has been hacked by user and u found they had exe the following command

find / -type f -exec chattr +ia {} \;

How do u recover the server .

Quote:

3. how to get the performance report of the server of jan 2012 of particular time betwwen 3.00 -5.00 pm without using any sort of external tool like nagios,opennnms

Thanks in advance if any anyone help to get the answer for the above three question .

anomie · 05-26-2012, 09:43 AM

I'd use pkill(1). It provides an option to kill processes for a UID.

For question #2, they may be expecting you to simply remove the immutable and append-only attributes. (But, honestly, I'd plan an outage - when possible - and do a complete system restore(8) instead. After determining how some malcontent got root access to begin with.)

For question #3, take your pick. The sysstat package is fairly popular.