Results 1 to 14 of 14
Thread: Strange File Permissions
-
08-24-2009, 06:30 PM #1Disabled
- Join Date
- Nov 2007
- Location
- England
- Posts
- 239
Strange File Permissions
Hey,
We have a client on CentOS with cPanel and their VPS is corrupt by the looks of things. We have tried to remove the following files but it won't allow us to, give an error of: "Operation Not Permitted".
Code:b--sr-s--t 30068 2036409384 539518322 111, 99 Feb 5 1987 autosave.dev.js ?--xrwx--x 29545 1668161637 1769236596 1629757501 Jul 24 2001 jquery cr-xr-Sr-t 28711 1948532000 1768431660 32, 44 Jul 1 2002 prototype.js ?--xrw-r-T 25459 1886217589 1950049576 740892711 Oct 17 2021 scriptaculous ?r-Sr-S--- 25973 1701668896 539455839 1936485748 Jul 4 1991 swfobject.js c--Sr----T 27728 1818312736 1701585011 114, 101 Jun 1 1975 wp-lists.js
Any help will be appreciated.
-
08-24-2009, 10:47 PM #2Web Hosting Master
- Join Date
- Aug 2002
- Location
- Superior, CO, USA
- Posts
- 635
Something is very bad here. The files that start with "b" or "c" are Unix devices, not regular files. Given that these are supposed to be JavaScript files and that the dates are not correct I'd say that this VPS needs to be reinstalled. Realistically only files in /dev would only have these flags set.
-
08-25-2009, 01:34 AM #3Web Hosting Industry Expert
- Join Date
- Dec 2007
- Location
- Indiana, USA
- Posts
- 19,196
Where are these files actually located at?
█ Michael Denney - MDDHosting.com - Proudly hosting more than 37,700 websites since 2007.
█ Ultra-Fast Cloud Shared and Pay-By-Use Reseller Hosting Powered by LiteSpeed!
█ cPanel • Free SSL • 100% Uptime SLA • 24/7 Support
█ Class-leading support that responds in minutes, not days.
-
08-25-2009, 01:40 AM #4Aspiring Evangelist
- Join Date
- Sep 2007
- Posts
- 369
-
08-25-2009, 01:44 AM #5Web Hosting Master
- Join Date
- Jun 2003
- Location
- World Wide Web
- Posts
- 581
Confirm in which directory you are viewing these files.
Also confirm this directory is not attributed. You can use the following command
lsattr /parentdirectoryname
for example this files are under /home/user/test, then you should run the above command as " lsattr /home/user "
Also some files are using the special permission stictybit ( T ), but you can remove those files as root user if the directory is not attributed.
Before removing those files confirm these are unnecessary.SupportExpertz.com - the name says it all!
Managed Cloud Servers
Server Management and Monitoring
24x7 outsourced customer support
-
08-25-2009, 06:37 AM #6WHT Addict
- Join Date
- Jun 2008
- Location
- India
- Posts
- 130
Where is the location of this files? try grep the created time in domlogs to verify it.
-
08-25-2009, 09:35 AM #7Temporarily Suspended
- Join Date
- Jul 2009
- Posts
- 178
Looks like the files have got corrupted.
restore them from backup and check out.
-
08-25-2009, 09:44 AM #8Disabled
- Join Date
- Nov 2007
- Location
- England
- Posts
- 239
The exact location is: /vz/private/127.old/home/scbuzz/public_html/blag/wp-includes/js/
We have tried to rebuild the VPS, however, it wasn't successful expressing that a device is busy.
We are planning to run FSCK on the host, but would rather not do that.
-
08-25-2009, 03:17 PM #9Aspiring Evangelist
- Join Date
- Sep 2007
- Posts
- 369
Please better try e2fsck in rescue mode.
when you delete file use -> rm -rf "filename*.*", might be some hidden space or something will be creating problem. I have faced many times such conditions and problem is resolved as i mentioned in this thread, if something else then need to check server properly.
-
08-27-2009, 07:47 AM #10Disabled
- Join Date
- Nov 2007
- Location
- England
- Posts
- 239
We shutdown the server and ran FSCK but it failed saying that a device is in use or busy.
That is the error we get when trying to delete these files.
Is there anything that can be done? As it seems these files are impossible to remove.
-
08-27-2009, 09:09 AM #11Aspiring Evangelist
- Join Date
- Sep 2007
- Posts
- 369
-
08-27-2009, 01:18 PM #12Disabled
- Join Date
- Nov 2007
- Location
- England
- Posts
- 239
Yes, we ran FSCK from recovery mode.
I'd rather not allow access since it is a working VPS host node.
If you want output of commands etc, just post them here and I'll do the needful.
-
08-27-2009, 05:18 PM #13WHT Addict
- Join Date
- May 2009
- Location
- /dev/null
- Posts
- 171
b--sr-s--t 30068 2036409384 539518322 111, 99 Feb 5 1987 autosave.dev.js
?--xrwx--x 29545 1668161637 1769236596 1629757501 Jul 24 2001 jquery
cr-xr-Sr-t 28711 1948532000 1768431660 32, 44 Jul 1 2002 prototype.js
?--xrw-r-T 25459 1886217589 1950049576 740892711 Oct 17 2021 scriptaculous
?r-Sr-S--- 25973 1701668896 539455839 1936485748 Jul 4 1991 swfobject.js
c--Sr----T 27728 1818312736 1701585011 114, 101 Jun 1 1975 wp-lists.js
As others said, this is really odd. Files timestamps are from the past and future and those ? marks indicates about file system corruption or some other issue. Do you have there enough disk space? I barely remember myself this issue but somehow this kind of behaviour remainds me nearing HDD crash or hardware failure.
Finally jquery is about 1.5GB of size etc. Definitely something is badly corrupted. What is inside of those files? like what command "tail -n 150 jquery" produces?
Something is not right with that anyway, block devices should be under /dev and nearly nothing creates device files outside /dev.
Also clock skew is possible there with some really nasty bug with VPS or something. Ask from your VPS host do there happened something strange with main host, might help as well.
When you have found solution for this, let us know.Last edited by GameFrame; 08-27-2009 at 05:23 PM.
█ NiX API - A powerful Anti-Proxy/Anti-Fraud and IP Reputation Lookup API
█ nixapi.com
-
08-27-2009, 09:23 PM #14Junior Guru Wannabe
- Join Date
- Sep 2008
- Posts
- 37
he is the provider of the VPS, vps was bought by vpsright.com, but a 1-2 weeks ago when they had the downtime the VPS never came back up i asked and the files you see above are what vpsright told me, 3.8 TB over the limit, but, we never made, or seen the account named "scbuzz" only WHM plugin's installed was a firewall, softaculous. is there like a virus that makes a account named scbuzz, from what vpsright says its in a directory format like wordpress. it began about: 22/08/2009 20:07. (i was busy while writting this so its has no correct grammer)
Similar Threads
-
Strange HTTPD permissions problem
By chrisksdf in forum Hosting Security and TechnologyReplies: 1Last Post: 03-12-2008, 08:49 PM -
Strange my.cnf permissions error
By 1EightT in forum Hosting Security and TechnologyReplies: 4Last Post: 08-22-2006, 01:51 PM -
CPanel file manager can't change file permissions
By labahost in forum Hosting Software and Control PanelsReplies: 10Last Post: 11-03-2003, 12:37 PM -
file permissions
By Pilgrim in forum Hosting Security and TechnologyReplies: 3Last Post: 09-24-2002, 02:05 AM -
File permissions
By kmurrey in forum Dedicated ServerReplies: 0Last Post: 03-11-2002, 10:55 AM