Security :: Grub.conf File Has Been Cleared On RHEL V4.7 Server
Mar 26, 2010
I am running Red Hat Enterprise Linux AS release 4 (Nahant Update 7). The server was recently rebooted and wouldn't come up. After some investigation we found that the system would not boot because several files had been zero'd out (not deleted):
* All of these files had a date of March 11, 2010 with a time 03:46
* A zero byte file called /halt was also found with a date of 08:46
We could manually boot to the latest kernel, but none of the startup scripts would run. We analyzed the system looking for any file created on March 11 that were also 0 bytes. Once we had a list, we were able to determine that the system could be recovered without a full blown reinstallation of the OS.
We did a rescue boot from the installation CD, mounted the system volume privately, and edited the grub.conf file. We then brought up the network and copied the needed files from another RHEL v4.7 system. Rebooted the server and check the OS, databases, and apps.
My question is - Has anyone seen this behavior before? I seems like we may have been cracked or at the very least someone has cleared the files needed to recover the system smoothly.
On a fresh karmic install, I have a user account with ecryptfs enabled home directory. I want that directory to be secured when I log out.
I have two administrator accounts, user1 and user2. I log in as user1 (with ssh, will test regular logins tomorrow), /home/user1/.Private gets mounted to /home/user1, everything is fine. I log out.
I log in as user2, and /home/user1/.Private is indeed unmounted. But I can do
Code: sudo su - user1 which will ask me for the password of user2, and then I am logged in as user1, /home/user1/.Private is again mounted, without ever typing the password of user1. On the other hand if I invoke Code: ecryptfs-umount-private
I would like to modify the boot loader settings and triedo open the file grub.confHowever, it is said that the file could not be opened, as seen in the attachment.Tried to authenticate as 'root' before opening the file, but the problem still exist...
is possible to edited the default RHEL CD to have it automatically install RHEL based off of a kickstart file that I will store locally on the CD. My plan would be to put a cd in a server and have the OS automatically being installed.
I installed 11.04 server and had samba share /tmp (as advised by the server pdf doc) shared to my windows 7 laptop, which was all well and good, so copied some files to it and rebooted the server, and they had been removed.i guess i shouldnt have put anything in /tmp as i presume this is cleared on reboot, so why did the documentation advise to create /tmp share?
I just recently installed a kernel, everything works fine after reboot except. When I use nano -w /boot/grub/grub.conf I get /boot/grub/grub.conf: No such file or directoryIs there something i have to do after installing a new kernel in Gentoo Linux.I can't access my /boot all that appears there is a symlink to /boot How can i see my kernels located in /boot.
I am trying to edit my grub.conf file. I am logged in as root. It says it is a read only file. I have tried to set permission with chmod 777 and also tried through GUI. Using VI it says it's a read only file. Using nano it will not write either. I have two choices on boot up. I want to automatically go to second automatically. First at the moment is CentOS-4 i386 (2.6.9-55.ELsmp) and second is CentOS-4 i386 (2.6.9-55.EL).
I'm trying to set up some shares on this pc and every time I try to edit the /etc/exports file I get this error. I get the same error when I try to edit /boot/grub.conf file or any other files. Does not matter what editor I use. I'm running f14.
I have a dual boot set up on my Dell Inspiron 1525 laptop I have Windows Vista originally installed and i installed RHEL 5 a while ago they used to sit happily together.However After upgrading RHEL 5 from 5.3 to 5.5 yesterday and configuring grub to boot into Vista by default it refuses to do that and boots into RHEL 5 by default.
The laptop used to boot straight into vista but i thought i,d learn how grub works by configuring it, after the rhel5 upgrade. But after changing the DEFAULT value from 0 to 1 and then back from 1 to 0 still grub only boots into RLinux RHEL 5 by default regardless. Can someone help me please i need to make my laptop boot straight into Windows Vista by default and not RHEL 5 This is what my grub.conf looks like
# grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that
I have an RHEL 4 server now running 2.6.9-89.0.18. After installing the kernel and rebooting to make this the current kernel, the grub menu to choose the kernel failed to offer a countdown and did not choose the kernel as it should have. I had to manually select the kernel.I inspected the grub.conf file and could not find any clue as to why it didn't work. The timeout directive is there, and the syntax matches other systems we have with the same kernel and OS.Can anyone provide any insight as to what else (other than a typo on the conf file) would cause this?The only difference between the way the kernel update (and the subsequent changes to the grub conf file) took place was a manual install of the RPM on the affected system, versus pulling it down from RHN using up2date.
I have a RHEL 5 Server dedicated to web hosting. HTTPD 2.2.x.x is running on it with PHP and MySQL. The machine is not a server system (hardware wise, a C2D 2.66 with 2GB RAM and 2 x NICs). I have a CIR Fiber link with a pool of live IPs. The machines including this web server is plugged into a switch which has all the live interfaces and is separate from the LAN switches. The problem i am facing is that, when ever this web server is plugged in, the traffic on live switch is choked. Internet slows down to a halt (as live interface of proxy is plugged in this switch. DNS stops resolving name due to time outs. Mail delivery is slowed and the mail ques pile ups. The moment i get this machine of the switch, all the traffic becomes normal. Therefore i have deduced that this is the faulty server. I do not know if this server is hacked and working as a bot or it is a mere hardware problem(faulty LAN Card).
When I submit a job via lpr on RHEL 5 using lpr -P MYPRINTER filename and then do a lpstat -t, the actual file name is not listed...just a job identifier e.g MYPRINTER-8 On AIX the lpstat command shows the actual print file name Using -C, -J or -T options in lpr also makes no difference to waht is seen in lpstat
Running Red Hat (not sure of the build atm) and I need to be able to put all of the IP blocking in a separate file. It will eventually be uploaded to a large number of hosting accounts, and modified from time to time...so it isn't feasible to modify that many httpd.conf files each time we need to add an IP to be blocked. In httpd.conf I can add the "Deny from" line to the following directive and blocks it just fine:
Code:
<Directory "/var/www/html"> # # Possible values for the Options directive are "None", "All", # or any combination of: # Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
[code]....
There is an include to pick up all *conf files in ../conf.d, and everything else in there is working just fine. I created a file called robots.conf; it currently has a set of mod_rewrite rules which work. So I added this to that file:
Code:
<Directory "/var/www/html"> Order allow,deny Allow from all Deny from 123.456.789.098 </Directory>
It is not blocking access from the IP with it in there.I've done all of the usual things; restarted Apache, cleared browser cache etc. I can also block it using that same directive in a local .htaccess.
I have a RHEL 5.3 server attached to an EMC Clariion. There are 24 36gb LUNs presented to my server. I have 4 paths to each LUN. I'm using native Linux multipathing. each LUN shows up 5 times (one for each path, and one for the multipath). I also have two internal logical drives, /dev/sda and /dev/sdb, and I want LVM to see them. I'm trying to get LVM to ignore the individual paths and I need help making my filter statement correct in /etc/lvm/lvm.conf. Here is my filter line:
since i have installed the nvidia drivers i have lost the graphical boot and just had a bar at the bottom of the screen instead. i tried to get the graphical screen back by adding vga=795 to my /boot/grub/grub.conf but when i rebooted not only did i not get the graphical boot or the toolbar at bottom.
i got list of all the drivers and services it is starting with ok next to it. i have also since doing this lost the bit when restarting or shutting down getting the words restarting or shutting down and just get blank screen with flashing cursor. i removed the vga=795 and i still get the list of drivers/services loading.
how do i get the quiet option back. i have checked /boot/grub/grub.conf and it has the quiet in it.i have also tried running update-grub but get message command not found. i have attached the grub.conf file
I've been scanning the apache2 docs for the past few days and have not come up with an answer my following issue:
In my httpd.conf file, at the very end, I have the line
Include conf/vhosts/vhost_*.conf
However, when I run apache checkconfig or try to start apache, it gives me the error:
httpd: Syntax error on line 993 of /etc/httpd/conf/httpd.conf: Could not open configuration file /etc/httpd/conf/vhosts/vhost_1.conf: Permission denied
It appears as if the Include line is correct - in terms of it grabbing the first virtual host conf file. However, I'm confused on the permissions. the /etc/httpd folder is owned by root:root, as are the subfolders. As a test, I chown'd the conf/vhost folder combination and all the vhost files to apache:apache to see if that made a difference, and it appeared to make no difference at all. The log files don't contain anything (assumed because apache isn't starting). If I place the contents of the vhosts in a singular vhosts.conf it works - with the permissions set to root:root. I'd like to avoid having to use one vhosts conf for the configuration I'm trying to achieve - as it would make my life a lot easier.
Is there a way to create a Seperate X Server on openSUSE 11.2 without editing the xorg.conf file? I red on this forum that should not be used any longer.
I turned my home PC running Ubuntu 10.04 into a server, and so i am so lost, after reading like a 10-20 different guides and/or official docs, I am totally lost.
All I wanted was to create a custom 404 error page...i read about how people edited .htaccess files to customize error pages, i tried and failed also, editing apache2.conf, I got lost and i dont wanna mess up everything and also, how you're supposed to not touch either of those as its not how it should be done and instead you need to edit httpd.conf and i did and FAILED! again...
Also how do I make it so that I can make subdomain(s) on my site? and wth is a name server and where do I get one?
We are planning to migrate our LINUX server from RHEL 3to RHEL 5. What are the configuration difference between RHEL 3 to RHEL 5 for webserver installations?
I've just done a fresh install of Lubuntu 10.10 on an older Sony Vaio laptop. Having learned the hard way about editing xorg files, I wanted to create a backup of the xorg.conf file so that I dont have to do another install when I screw everything up. In a terminal, I typed
I have a database server running RHEL 5.1 32 bit that suffered some catastrophic failures about 6 months ago. We were able to patch it back together and keep it running, but now the manufacturing site it supports is going to shut down for two weeks and I would like to replace it permenantly. Does anyone have any guidance for that sort of thing? I'd like to have the new server up and running before hand, basically changing the hostname/ip and restoring the databases only on conversion day. I've done this in the past with HP UX - Red Hat conversions, but this is my first red hat to red hat move. Any advice or shortcuts?I forgot to add the other wrinkle. The new server will be running 64bit linux.
accidentally I do something wrong with my server and the httpd folder missing and I need it to setup my mail server and anyone can help me what can I do without reinstalling my Cent OS? Here is the error msg :
[root@mydomain etc]# service httpd stop Stopping httpd: [FAILED] [root@mydomain etc]# service httpd restart
when I quit Ubuntu Forums, I getvBulletin MessageAll cookies cleared! When I restart, I have to LogIn againWhere do I fix it, so that Cookies are not cleared on LogOut?(I'm using Win2K and FireFox 3.6.3)nFireFox Privacy Clear History when FireFox closes.ccept cookies from Third Party is checked
I am using Cent OS 5.5 and i want configure DNS, but while configuring bind i am getting below error.
#/etc/init.d/named restart Stopping named: [ OK ] Starting named: Error in named configuration: /etc/named.conf:57: open: /etc/named.root.hints: file not found[FAILED]
I am running an application that requires use of my /etc/hosts file. In it, I have my machine name and its LAN ip address. The program creates a service on a specific port, then attempts to connect to it based on the host name. So my hosts file has to be correct.I added the nameservers to resolv.conf and now my application will not run. My guess is that the computer is checking the name servers first, timing out then checking the hosts file.Is there a way I can tell the system to check the hosts file first, then DNS. I thought it should behave that way by default, but it does not appear to.
