Re: /sbin gone

["STeve Andre'" <andres@msu.edu>]

On Saturday 21 February 2004 07:06 pm, Greg Thomas wrote:
> I woke up this morning to find my backup script failed and the
> following in daily insecurity:
>
> Checking setuid/setgid files and devices:
> Setuid deletions:
> -r-sr-xr-x 1 root bin 178892 Sep 17 01:59:36 2003 /sbin/ping
> -r-sr-xr-x 1 root bin 194860 Sep 17 02:00:12 2003 /sbin/ping6
> -r-sr-x--- 1 root operator 161164 Sep 17 01:59:44 2003 /sbin/shutdown
>
>
> ======
>
> I logged in and /sbin is gone.
>
> It doesn't appear that I've been cracked or anything as I'm currently
> up with -stable and as /sbin missing seems to be the only problem.
>
> I see the following in /var/log/messages:
[snip]

I'd take that disk and put it in another machine to suck the data off
it, then I'd get a  new disk.

--STeve Andre'