Security :: Tmp Filling Up With Root-tmp Diretories?
Apr 26, 2010My /tmp directory is being filled up with root-tmp.####. I suspect they are being created by bastille-tmpdir-defense.sh, but they do not seem to get removed.
View 7 RepliesMy /tmp directory is being filled up with root-tmp.####. I suspect they are being created by bastille-tmpdir-defense.sh, but they do not seem to get removed.
View 7 RepliesI'm booting to Kali 2.0 live from USB and wanted to add persistence, but I can't get OpenVAS setup. The setup script runs and eventually fails due to no more disk space. Here's my df -h output:
Here's gparted:
When the setup runs it fills up root (/) which is only 872mb. This is a 16gb USB so I'm wondering if there's a way to allocate some of the 11gb of unallocated space to root? I couldn't tell how to do this with gparted, would I need to build a custom Kali iso or something with different partitioning?
I have a number of servers I manage, and one of them is archiving old data that is never modified on a separate partition. This partition is at 100% capacity. A friend of mine says this is an unsafe way to keep this partition, even tho I don't plan to add any more data to it or change anything within. I know I can archive the data to dvd, but I'd like to keep the data online for my users.
What are your opinions on this? Can I keep this archive partition at 100% capacity? Or do I risk some sort of data corruption? Should I mount this partition as read-only to help prevent any corruption?
I'm getting the following messages sent to my root account mailbox. It appears to be reporting an issue finding ntpdate, however when running the following command:
aptitude show ntpdate | grep State
It shows as installed and any ntpdate commands work with no issues, so I have no idea why this is getting regularly reported?
From root@mydomain.co.uk Wed Feb 03 18:20:01 2010
Return-path: <root@mydomain.co.uk>
Envelope-to: root@mydomain.co.uk
Delivery-date: Wed, 03 Feb 2010 18:20:01 +0000
[Code]....
I have a batch job which logs in to the server every 10 minutes via windows rsh. The job checks to see is there are any files that need to be send via a EDI serverto a supplier.The following logwatch report is swamped with the login messages and would like to either suppress the logging in PAM? or suppress the entry in the logwatch report?But I still want logging id the username is not username1.Connections (secure-log) Begin rshd[1754]: pam_rhosts_auth(rsh:auth): allowed to username1@10.0.0.1 as myedi
View 2 Replies View RelatedI was using dd if=/dev/zero of=/dev/user name/wipe.conf however i got a message that my hard drive is full.
lots of this is scary - dangerous. what is the best way to fill in random or zeros in deleted files without the hard drive filling up ?
I work for a company that makes portable devices running Linux and I was recently asked to make the underlying file system read-only for "security" purposes. Since the distribution is based on LinuxFromScratch, I know that very little writing happens at run time. So, even if the device runs on a usb flash device, I doubt that putting the root file system RO will be that beneficial. I am actually more concerned about a process actually breaking because it cannot open a file in RW mode than a process going rogue and filling the root file system with log files, etc. I'd really like to ear what kind of advantages disadvantages there really is with read-only file-systems.
View 6 Replies View RelatedI am a non-root user, and have made a directory into which other users in my group can write. The directory is setgid, so files and directories within it have the same group.I can delete files placed into this directory, but if a user creates a subdirectory with files in it, I can't seem to delete those. Is there something special I can do (other than, say, bothering the user in question or the sysadmin about it) to get rid of this subdirectory?
EDIT: Inevitably, of course, someone asks "why?"The shared folder in question is a mercurial repository. We can't use a shared-account ssh-key-based server for this like mercurial-server, and we can't just host it externally for various reasons. But that part works fine.We use Redmine for project management, but it does not yet read the repo index for file contents - it reads the working directory. So the working directory must be kept up-to-datecrontab has been disabled by the sysadmin, so that's out. So I naïvely put a changeset hook in the shared repo that performed an "hg update". This seemed to work fine initially, until, of course, someone pushed a commit with a new directory. While I had vague thoughts of trying to make a setuid script for the hook, I'll probably just consider safer avenues.
want to run VirtualBox with root permissions. Trouble is that only when run as root i can access attached USB devices inside of a virtual machine, otherwise, these a greyed out).Now running VirtualBox as a root user also changes the configuration folders, making all my virtual machines already defined disappear. I also don't want to copy all to the root configuration folders. Is there a way to give the VirtualBox root permissions but without actually running the application as a root user. Is it possible to do without changing the permissions of the non-root user, i.e. i don't want my user to have all root permissions, due to security considerations.
View 1 Replies View RelatedI run ProFTPd with TLS authentication on my Debian Lenny server. My problem is that despite of the fact that my users connect chrooted, one of my friends had root privileges after logging in form a Macintosh and could browse the root directory, too.
View 1 Replies View RelatedHaving read on the forums about some of the dangers of running Wireshark as root, I would like to know if anyone can suggest some alternative packet sniffers/network analyzers which will offer similar results but without the security issues. I am using Karmic Koala on a Fujitsu Siemens laptop with wireless router (firewall enabled)
View 7 Replies View RelatedWhenever I login as root, an e-mail with the subject "Security information" is sent outwhere the e-mail address for this message is configured? I need to change it (or perhaps disable it).
View 9 Replies View RelatedI found this on Bee's website. For more info on this exploit there are links there:[URl]..All you have to do in Fedora 13 is enter the following lines in a shell as normal user:
[Code]...
I don't think this can be considered solely an "upstream" problem, because I first tried it in Arch using the same version of glibc, and the final command causes both gnome-terminal and xterm windows to disappear.
openSUSE 11.1, KDE 4.4.1
I'm getting ~/.nfs file being generated and just filling up
Does anyone know the cause - and how to stop it before it fills my HDD?
I have a pre-printed form that I need to fill in. Is it possible to scan it, fill it in on screen, and then put the original form in the printer and get things to print out on that original form? I know that I can scan the form and fill it in on screen and print out on a blank piece of paper, but I need to use the original form
View 9 Replies View RelatedFor a while my root partition has been filling up for no apparent reason. I I have been deleting things to find out it fills up again in a mater of days. To make it more 'interesting', there is a disparity between what I get from df and what the du command is telling me. After dismounting the other file systems and turning off applications, this is what i get:
output of df -ha
Code:
Filesystem Size Used Avail Use% Mounted on
/dev/sdf5 69G 66G 54M 100% /
proc 0 0 0 - /proc
none 0 0 0 - /sys
[code]....
du claims that I'm using 29G on that partition, which sounds about right (this is my OS and basic /home partition, everything else is elsewhere). df on the other hand is telling me here that out of 69G, 64G are in use with only 54M left.
I have a lot of data on a nfs store external to an Ubuntu machine. I've had problems with the storage becoming full and have spent a very long time deleting files to get absolutely nowhere! Over 25GB of deletions on the 80GB disk has only cleared 1.5GB of space...
You can see below the hidden .snapshot directory, the disk usage for the nfs-store is coming out at 97GB when the disk is only 80GB in size, and the two directories I want on the disk are about 22GB in size.The .snapshot directory appears to have been made on Friday, I'd like to know if I can:
1) find out what command ran to create/update it
2) re-run the command to update the directory or remove the directory
Code:
ideasadmin@ideasadmin-desktop:/nfs-store$ ls -la
total 20
drwxr-xr-x 5 500 500 4096 2010-07-16 17:35 .
[code]......
Noticed that one of my partitions on openSuse 11.1, mounted as /usr, filled up suddenly with over 20 GB of something. Tracked it down to /usr/bin, in which the X11 directory contains 2353 items and another X11 directory, recursively at least 11 times that I've expanded without reaching the last X11 directory. The newest files in each directory are dated 11/24/10.
Any idea of what's happening? How to stop it before it fills the disk?
I am relatively new to ubuntu/linux and although I have made some good progress on my server I'm struggling with a few points. I am sure what I'm about to ask has been covered in some other thread/guide but I just cant pick out the missing piece hence my direct question;I have 2 computers; a server and mediacenter.on the server I have installed nfs:
Code:
sudo apt-get install nfs-kernel-server nfs-common portmap
then
[code]....
Just today I started getting notices about lack of disk space on my system. After much digging I found that .xsession-errors and .xsession-errors.old were taking nearly 70GB of space combined. The primary message I'm getting over and over again is: SSL_Write: I/O Error I have been unable to figure out what's causing this error.
View 3 Replies View RelatedSome of my cronjobs are filling up files in my / directory. How do I make this stop? One of my cron jobs uses wget:[URL].. The bexcb0.php file writes a file and then echos a result if it is sucsesfull. These echo results are being put into bexcb0.php files in my /root folder and are piling up.
My / folder is filling up with files bexcb0.php etc bexcb0.php bexcb0.php.1 bexcb0.php.2 bexcb0.php.3 bexcb0.php.4 bexcb0.php.5 etc How do I make this stop? If I just remove the echo will they stop writing to the / folder?
I am using my ubuntu server as my home router.Everything is working as expected with one exception.y DSL modem is a POS and every now and again it looses connection to the router. Sometimes it needs to be reset and sometimes it does not.Either way, when this happens my ubuntu server needs to reacquire an IP from my ISP. If it screws up when I'm at home it's no big deal, but if it happens when I'm not around my housemates have taken to hitting the reset switch on the server. I'm not a big fan of this so I wrote a script to ping my ISP's gateway. If it's unavailable it bounces the eth0 interface and tries to get an IP. I am running this script every couple of minutes in a cron job. Now I'm getting syslog entries like
Code:
Aug 9 20:31:01 portal CRON[9602]: (root) CMD (/opt/ChkAndFixNetwork.sh)
every few minutes. This is annoying and makes the logs useless for troubleshooting. I
[code]...
I have some ideas about writing a small game in terminal ( just for fun ) using ncurses library. I want to use some kind of menus (in Midnight Commander's style), but there are some problems with rendering windows, that I don't understand. I create a window with newwin(), assign a color pair to it calling wattron() (for example, I want to fill a window with blue background), and then I call my own function wnd_fill() :
Code: void wnd_fill (WINDOW* wnd)
{
int i;
[code]...
I have the following BIND messages filling up my SysLog that I'm hoping someone can explain to me:
Code:
Dec 9 09:35:44 dns2 named[30103]: client 67.130.224.5#49551: query (cache) 'www.domain.com/A/IN' denied
Dec 9 09:35:47 dns2 named[30103]: client 67.130.224.5#64561: query (cache) 'www.domain.com/A/IN' denied
[code].....
I would expect this behavior if "domain.com and anotherdomain.com" wasn't a domain that I hosted. But this is a valid domain that this server should be answering for. In my named.conf I do have the
Quote:
allow-query { any; };
option on every zone. This is my slave server and I have the primary shut off so I can test this slave server. FYI: So far queriers still seem to be working. The pages for the sites are still coming up via the internet.
I have a fedora 10 server to which I can ssh as the root user using RSA.
However for any user other than root a password is always requested.
I have made changes to PAM and check the rights to all the files and read pages upon pages. I can mess it up completely so no one can login but cant get it so that anyone other than root can use a public key.
Another interesting and may be related item is that when any user logs in, with a password, via ssh then they get the error:
Could not chdir to home directory /home/xxxx: Permission denied
But they can cd to their home directory and have no problems.
I am thinking that this may be to do with the mount. The home directory is on a HDD but the system dive is an SSD.
I have gone over everything so many times I am now lost, I must be overlooking something so simple and obvious its just not coming to mind.
When I try to issue "su -", I get "su: Authentication failure", and I'm 100% sure password I enter is ok.
I think it started to happen after I issued
chmod +s /usr/bin/screen
chmod 755 /usr/bin/screen
which I believe is unrelated to this problem, and,
chmod -s /bin/su (-s by mistake)
chmod 755 /bin/su
which most probably made the whole mess...
this is not the part of the problem I believe but here's some background why I did that... when trying to make possible for screen sessions to be started automatically on boot under non-root account, I entered something like "su - username -c "/usr/bin/screen -dmS screenname ./executable-file"" in bootmisc.sh, but I was getting "must run suid root for multiuser support", so I tried to fix it, and now I can't login to root account no way.
Running Debian lenny.Is there any way to run
Code:
$ chage --expiredate some_date user1
chage: Permission denied.
[code]....
I need to launch a bash file in Linux from an unprivileged user session, file that will run bash commands as root. But I do not want to create an user with root privileges to do that also the process must be silent (no password asked).
How can I do this without adding a user in sudoers and without giving rights to all users to execute the commands from that bash file?
I have tried SUID option witch would had been good as functionality but I understand that SUID doesn't work for script bash files.
My filesystem is almost full and the problem is in the proc folder.What does that folder contain and can I delete something from it?
View 1 Replies View RelatedWhen building 8.04 servers, I reconfigure snmpd's logging options to prevent copious low priority messages being logged whenever our network management workstation polls them. I edit /etc/default/snmpd and change line 11 from:
Code:
SNMPDOPTS='-Lsd -Lf /dev/null ...'
to:
[code]....