Results 1 to 14 of 14
  1. #1
    Join Date
    Nov 2007
    Location
    England
    Posts
    239

    Strange File Permissions

    Hey,

    We have a client on CentOS with cPanel and their VPS is corrupt by the looks of things. We have tried to remove the following files but it won't allow us to, give an error of: "Operation Not Permitted".

    Code:
    b--sr-s--t 30068 2036409384  539518322   111,  99 Feb  5  1987  autosave.dev.js
    ?--xrwx--x 29545 1668161637 1769236596 1629757501 Jul  24  2001 jquery
    cr-xr-Sr-t 28711 1948532000 1768431660    32,  44  Jul  1  2002 prototype.js
    ?--xrw-r-T 25459 1886217589 1950049576  740892711  Oct 17  2021 scriptaculous
    ?r-Sr-S--- 25973 1701668896  539455839 1936485748  Jul  4  1991 swfobject.js
    c--Sr----T 27728 1818312736 1701585011   114, 101  Jun  1  1975 wp-lists.js
    We've been investigating it for the last 24 hours with no avail.

    Any help will be appreciated.

  2. #2
    Join Date
    Aug 2002
    Location
    Superior, CO, USA
    Posts
    635
    Quote Originally Posted by VPSRight View Post
    Hey,

    We have a client on CentOS with cPanel and their VPS is corrupt by the looks of things. We have tried to remove the following files but it won't allow us to, give an error of: "Operation Not Permitted".

    Code:
    b--sr-s--t 30068 2036409384  539518322   111,  99 Feb  5  1987  autosave.dev.js
    ?--xrwx--x 29545 1668161637 1769236596 1629757501 Jul  24  2001 jquery
    cr-xr-Sr-t 28711 1948532000 1768431660    32,  44  Jul  1  2002 prototype.js
    ?--xrw-r-T 25459 1886217589 1950049576  740892711  Oct 17  2021 scriptaculous
    ?r-Sr-S--- 25973 1701668896  539455839 1936485748  Jul  4  1991 swfobject.js
    c--Sr----T 27728 1818312736 1701585011   114, 101  Jun  1  1975 wp-lists.js
    We've been investigating it for the last 24 hours with no avail.

    Any help will be appreciated.
    Something is very bad here. The files that start with "b" or "c" are Unix devices, not regular files. Given that these are supposed to be JavaScript files and that the dates are not correct I'd say that this VPS needs to be reinstalled. Realistically only files in /dev would only have these flags set.

  3. #3
    Join Date
    Dec 2007
    Location
    Indiana, USA
    Posts
    19,196
    Where are these files actually located at?
    Michael Denney - MDDHosting.com - Proudly hosting more than 37,700 websites since 2007.
    Ultra-Fast Cloud Shared and Pay-By-Use Reseller Hosting Powered by LiteSpeed!
    cPanel • Free SSL • 100% Uptime SLA • 24/7 Support
    Class-leading support that responds in minutes, not days.

  4. #4
    Join Date
    Sep 2007
    Posts
    369

    *

    Quote Originally Posted by VPSRight View Post
    Hey,

    We have a client on CentOS with cPanel and their VPS is corrupt by the looks of things. We have tried to remove the following files but it won't allow us to, give an error of: "Operation Not Permitted".

    Code:
    b--sr-s--t 30068 2036409384  539518322   111,  99 Feb  5  1987  autosave.dev.js
    ?--xrwx--x 29545 1668161637 1769236596 1629757501 Jul  24  2001 jquery
    cr-xr-Sr-t 28711 1948532000 1768431660    32,  44  Jul  1  2002 prototype.js
    ?--xrw-r-T 25459 1886217589 1950049576  740892711  Oct 17  2021 scriptaculous
    ?r-Sr-S--- 25973 1701668896  539455839 1936485748  Jul  4  1991 swfobject.js
    c--Sr----T 27728 1818312736 1701585011   114, 101  Jun  1  1975 wp-lists.js
    We've been investigating it for the last 24 hours with no avail.

    Any help will be appreciated.

    Please also check e2fsck -f /dev/your-mount point where these files exist, then try, may be it works.
    Thanks,
    Noman
    noman@linuxonsupport.com
    O Canada, we stand on guard for thee

  5. #5
    Join Date
    Jun 2003
    Location
    World Wide Web
    Posts
    581
    Confirm in which directory you are viewing these files.

    Also confirm this directory is not attributed. You can use the following command

    lsattr /parentdirectoryname

    for example this files are under /home/user/test, then you should run the above command as " lsattr /home/user "

    Also some files are using the special permission stictybit ( T ), but you can remove those files as root user if the directory is not attributed.

    Before removing those files confirm these are unnecessary.
    SupportExpertz.com - the name says it all!
    Managed Cloud Servers
    Server Management and Monitoring
    24x7 outsourced customer support

  6. #6
    Join Date
    Jun 2008
    Location
    India
    Posts
    130
    Where is the location of this files? try grep the created time in domlogs to verify it.

  7. #7
    Join Date
    Jul 2009
    Posts
    178
    Looks like the files have got corrupted.

    restore them from backup and check out.

  8. #8
    Join Date
    Nov 2007
    Location
    England
    Posts
    239
    The exact location is: /vz/private/127.old/home/scbuzz/public_html/blag/wp-includes/js/

    We have tried to rebuild the VPS, however, it wasn't successful expressing that a device is busy.

    We are planning to run FSCK on the host, but would rather not do that.

  9. #9
    Join Date
    Sep 2007
    Posts
    369

    *

    Quote Originally Posted by VPSRight View Post
    The exact location is: /vz/private/127.old/home/scbuzz/public_html/blag/wp-includes/js/

    We have tried to rebuild the VPS, however, it wasn't successful expressing that a device is busy.

    We are planning to run FSCK on the host, but would rather not do that.

    Please better try e2fsck in rescue mode.

    when you delete file use -> rm -rf "filename*.*", might be some hidden space or something will be creating problem. I have faced many times such conditions and problem is resolved as i mentioned in this thread, if something else then need to check server properly.
    Thanks,
    Noman
    noman@linuxonsupport.com
    O Canada, we stand on guard for thee

  10. #10
    Join Date
    Nov 2007
    Location
    England
    Posts
    239
    We shutdown the server and ran FSCK but it failed saying that a device is in use or busy.

    That is the error we get when trying to delete these files.

    Is there anything that can be done? As it seems these files are impossible to remove.

  11. #11
    Join Date
    Sep 2007
    Posts
    369

    *

    Quote Originally Posted by VPSRight View Post
    We shutdown the server and ran FSCK but it failed saying that a device is in use or busy.

    That is the error we get when trying to delete these files.

    Is there anything that can be done? As it seems these files are impossible to remove.
    You mean in rescue mode please confirm? is it possible i can check server you can pm me the details if you want me to check.
    Thanks,
    Noman
    noman@linuxonsupport.com
    O Canada, we stand on guard for thee

  12. #12
    Join Date
    Nov 2007
    Location
    England
    Posts
    239
    Yes, we ran FSCK from recovery mode.

    I'd rather not allow access since it is a working VPS host node.

    If you want output of commands etc, just post them here and I'll do the needful.

  13. #13
    Join Date
    May 2009
    Location
    /dev/null
    Posts
    171
    b--sr-s--t 30068 2036409384 539518322 111, 99 Feb 5 1987 autosave.dev.js
    ?--xrwx--x 29545 1668161637 1769236596 1629757501 Jul 24 2001 jquery
    cr-xr-Sr-t 28711 1948532000 1768431660 32, 44 Jul 1 2002 prototype.js
    ?--xrw-r-T 25459 1886217589 1950049576 740892711 Oct 17 2021 scriptaculous
    ?r-Sr-S--- 25973 1701668896 539455839 1936485748 Jul 4 1991 swfobject.js
    c--Sr----T 27728 1818312736 1701585011 114, 101 Jun 1 1975 wp-lists.js

    As others said, this is really odd. Files timestamps are from the past and future and those ? marks indicates about file system corruption or some other issue. Do you have there enough disk space? I barely remember myself this issue but somehow this kind of behaviour remainds me nearing HDD crash or hardware failure.

    Finally jquery is about 1.5GB of size etc. Definitely something is badly corrupted. What is inside of those files? like what command "tail -n 150 jquery" produces?

    Something is not right with that anyway, block devices should be under /dev and nearly nothing creates device files outside /dev.

    Also clock skew is possible there with some really nasty bug with VPS or something. Ask from your VPS host do there happened something strange with main host, might help as well.

    When you have found solution for this, let us know.
    Last edited by GameFrame; 08-27-2009 at 05:23 PM.
    NiX API - A powerful Anti-Proxy/Anti-Fraud and IP Reputation Lookup API
    nixapi.com

  14. #14
    Join Date
    Sep 2008
    Posts
    37
    he is the provider of the VPS, vps was bought by vpsright.com, but a 1-2 weeks ago when they had the downtime the VPS never came back up i asked and the files you see above are what vpsright told me, 3.8 TB over the limit, but, we never made, or seen the account named "scbuzz" only WHM plugin's installed was a firewall, softaculous. is there like a virus that makes a account named scbuzz, from what vpsright says its in a directory format like wordpress. it began about: 22/08/2009 20:07. (i was busy while writting this so its has no correct grammer)

Similar Threads

  1. Strange HTTPD permissions problem
    By chrisksdf in forum Hosting Security and Technology
    Replies: 1
    Last Post: 03-12-2008, 08:49 PM
  2. Strange my.cnf permissions error
    By 1EightT in forum Hosting Security and Technology
    Replies: 4
    Last Post: 08-22-2006, 01:51 PM
  3. CPanel file manager can't change file permissions
    By labahost in forum Hosting Software and Control Panels
    Replies: 10
    Last Post: 11-03-2003, 12:37 PM
  4. file permissions
    By Pilgrim in forum Hosting Security and Technology
    Replies: 3
    Last Post: 09-24-2002, 02:05 AM
  5. File permissions
    By kmurrey in forum Dedicated Server
    Replies: 0
    Last Post: 03-11-2002, 10:55 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •