Security :: Can I Change Entries In Inode Table Of A File (Linux)
May 19, 2011
Anyone, I would like to ask if it was possible to change the entries of a file's inode table ?
For example
Code...
I was wondering if I can change the entries in this inode table's entries.
For example I want to change the "Modify" entry ? I want it to reflect to day 2009-05-19 for example.
I was using gparted from a live usb to resize an ext4 partition and it failed while running resize2fs. The error it gave was
Code: resize2fs: The inode is from a bad block in the inode table while trying to resize /dev/sda5 please run 'e2fsck -fy /dev/sda5' to fix the filesystem after the aborted resize operation.
I have a machine running Arch Linux (2010, I believe) with a 6TB RAID-5 array hooked up to a Highpoint RocketRaid 2320. I've been having issues with the RAID controller's drivers and the latest Linux kernels thanks to the driver not being open-source, and as a result I am migrating the system to Windows Server.Problem is that the 6TB disk originally was comprised only of an ext4 partition.I shrunk the partition down as much as I could, and added a NTFS partition in the empty space so I could start moving files. That went fine. Problem is that now I need to shrink the ext4 partition again, move files, shrink again, etc. The second run through resize2fs is taking way longer than the first pass.It seems to be getting stuck at pass 3:
[root@nar-shaddaa rc.d]# resize2fs -p /dev/sdb3 863000000 resize2fs 1.41.14 (22-Dec-2010) Resizing the filesystem on /dev/sdb3 to 863000000 (4k) blocks.
I have encountered something of a mystery here. The other day while in /dev I ran 'ls sda*' and noticed this...Quote:
ls -lZ /dev/sda* brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda1
I got a new ipod touch the other day and have been unable to get anything to read it properly. it automounts just fine and i can browse the file system. Normally with my old ipod i just used gtkpod and it worked fine. With gtkpod you have to tell it where the ipod is mounted. The problem is that i cannot see where the ipod touch is mounted It is connected right now and i can see it in nautilus and i can browse the file system, however...
[code]...
Partition table entries are not in disk order. what the?
I decided to take an old Gateway that I bought off a guy cheaply and turn it into a file and web server.I purchased copies of Debian 5.0.4 i386 disks (31 in all) on the advice of a friend, the disks weren't expensive, but now that Ive installed all the disks, I'm having a variety of errors
[443.110940 end request: I/O error, dev hde, sector 76021855 [443.111074] EXT3-fs error (device hde1): ext3_get_inode_loc: unable to read inode block - inode=2375715, block=9502724 INIT: cannot execute "/sbin/getty"
I have Celeron 2800D, 512 RAM (2 slots 256 each). I'm trying to install CentOS 5.2, it asks me about installation type (I tried graphic and text already, it stuck anyway), then after I press enter it shows me "Mount-cache hash table entries: 512" and that's all. I waited severl mins, it doesn't move. I tried to reboot pc several times, it's same. Then I removed 256 and left only 1 slot. and it's fine! I installed centos successfuly. Then I inserted second memory and centos does't load. I see some colored (each time new color) text that changes very fast and then black screen. I connected other HDD with WinXP, it runs fine, it shows me 512 mb, I can lunch Visual studio 2005 fine, etc. But centos just stuck each time if I have memory in both slots.
I was wondering if it was possible to display inodes of deleted files using a command. If yes, is it possible to recover the deleted files from their inodes?
Can we find the inode of a particular file using its inode number?
The reason is i want to know how many blocks are occupied by specific file.
if we consider block size of 1K. if the file size is of 100 bytes. In such a case, when the file is stored on disk, the file will occupy 100 bytes or 1K (since we have choosen block size to be 1K) ?
If you create a file on UNIX/linux with special chars, like touch "la*, you can't remove it with rm "la*. You have to use the inode number(you can if you add the before the name, I know, but you'd have to guess as a user that it was used in the file creation).
I checked the manpage for rm, but there's no metion of the inode number. Doing rm inodenumber doesn't work either.
Like many (most?) home users, until now I've had my regular userid in sudoers as "ALL = (ALL) ALL". It occurs to me that, even though my machine has no open ports, this is probably not a good idea - just in case my firewall suddenly burns down. So, if my thinking is right on this, I'm wondering if there is a generally approved list of Cmnd_Alias entries? At this point, I've decided to only add entries as I use them, and to try to honestly appraise my need to do the entry as sudo, vs opening a virtual console as root. My root password is non-trivial.
I have been getting the following in the samba section of the log watch report for the past few days. But don't know what it means.
[Code]....
and more. What does it mean? Does it mean any attempt to hack or is it some kind of status update? If this is not a threat and can be suppressed, how can I do this?
SELinux is preventing /usr/sbin/httpd from using potentially mislabeled filesjk-runtime-status. SELinux has denied the httpd access to potentially mislabeled filesjk-runtime-status. This means that SELinux will not allow httpd to use these files. If httpd should be allowed this access to these files you should change the file context to one of the following types, httpd_tmp_t,
I know how to change the owner of a file and the permissions but what does it mean to change the file context?
CentOS 5.6 Server patched to latest, multiple name-based apache virtual hosts. SELinux OFF Everything was working fine until the other day. I've been making quite a lot of changes so it may well be something I've done, but I can't find out what! Last night I got the following in my logwatch : -
Requests with error response codes 404 Not Found /admin/phpmyadmin/scripts/setup.php: 1 Time(s) /admin/pma/scripts/setup.php: 1 Time(s) /admin/scripts/setup.php: 1 Time(s) /db/scripts/setup.php: 1 Time(s) /dbadmin/scripts/setup.php: 1 Time(s) [Code]...
The problem is that NONE of my logs, secure, httpd, messages, NONE of them, show any trace of these hacking attempts. They used to show up in secure and apache error logs, but no longer.
My grub2 boot entries never change. I have run sudo update-grub and it finds all the proper kernels and such and says that it has updated. I check with the menu.lst and grub.cfg and they both look to be correct
I was just looking around and did a tail on my syslog and some strange entries came up:
[Code].....
I'm a Verizon customer in Maryland, USA running Linux at my home and I don't understand why named is looking at servers in France and Saudi Arabia. Am I just being paranoid?
Some time back using this computer a SucKit rootkit was found. Having dd urandomed the drive, flattened CMOS battery, flashed BIOS, run Knoppix live CD 6.1,using no flat pack battery (laptop), and memtested the RAM, I am still having problems with what I suspect is a javascript file that tries to reload the rootkit from? firmware. I suspect the firmware as everything else should have eradicated it??
Also it or a hacker via a backdoor then corrupts the drivers so devices malfunction. Windows security programs and rootkit detectors don't seem to pick it up. Fresh install of Windows or linux after the above still show this problem, though internet not used. The person who admitted rootkitting this machine is capable of writing java programs or using javascripts to do all this.
When viewed using Ubuntu 8.4 files and dates on a Windows partition appear normal both in file manager and terminal. However booting using Knoppix CD these files are all green, and I cannot change their permissions, even as root. ie: everything is green including text files etc. If I copy them to a linux partition, I can change their permissions and make them nonexecutable and nonwritable. Also on the Windows FAT32 partition the . directory has the date 1 Jan 1970.
If I disable any green files, I can shutdown and reboot cleanly. If I don't I start having problems shutting down [/usr/sbin/init ?] And always these follow a pattern:
Can't remember details as I have now corralled the beast but error messages relating to:
I run lastb every now and again to see who is trying to p0wn my box and it dates back to november 08. how do i clear these entries to i can get a more update view? or if you know a way i can do a 'more' or something so the IP's are not flying by that would be cool too!
I've noticed on a couple of occasions that e-mail address auto-complete drop down lists have e-mail addresses in that I have never entered (!!) They all seem to be for people with the surname fenton at either gmail or hotmail. Is it likely that I have been hacked?
My Linux server which is running my company website have been hacked. Today I saw a number of clients (customers) with some fun characters entries on my database. Access denial on really clients. Please assist, am running Linux Ubuntu 9 and I dont know where to start troubleshooting this. let me confession that I am still on the learning curve on Linux
It's quite easy to change the default boot entry through etc/default/grub. However, this only allows for the first entry to be changed. I want to be able to move all the entries in any order I like. What is the best/easiest way to do this?
i have ubuntu 10.10 installed using wubi inside win7.when i power on the pc, i get a black screen with three os options :windows 7, ubuntu, ubuntu. there are 2 ubuntu options probably due to uninstalling of wubi and reinstalling of it.
both ubuntu entries lead to the same os, but i wish to get rid of one of them (for aesthetic reasons), i also wish to change the time out of this screen. btw, how is this screen called ? (as i think this is not the grub menu screen. am i right ?)