[1512] in RedHat Linux List
Re: intrusion?!
daemon@ATHENA.MIT.EDU (Ian Burrell)
Mon Oct 28 19:29:01 1996
To: redhat-list@redhat.com
Date: Mon, 28 Oct 1996 15:51:02 -0800 (PST)
In-Reply-To: <199610281805.NAA11154@redhat.com> from "Wierdl Mate" at Oct 28, 96 12:52:14 pm
From: Ian Burrell <iburrell@leland.Stanford.EDU>
Reply-To: iburrell@leland.Stanford.EDU
Resent-From: redhat-list@redhat.com
>
> error: error: inode information changed for No such file or directory!!!this indicates a possible intrusion attempt
>
> Is it possible that this is just caused by moving /tmp to a different
> disk and now I have the link
>
> tmp -> /disk02/tmp/
>
I got the same error message after moving my /var/tmp to a different
disk and making the link. The solution so you don't get this message
every day is to change the tmpwatch line to use the actual path name.
Mine is:
/usr/sbin/tmpwatch 240 /tmp /scr/var/tmp
In addition, I removed that line and put it in its own file,
/etc/cron.daily/prunetmp.cron. I actually did the same with
everything else (well, I don't do the log pruning) so it uses the
consistent run-parts method.
- Ian
--
-- Ian Burrell == iburrell@leland.stanford.edu **
<URL:http://www-leland.stanford.edu/~iburrell/>
No matter how much you know, you will never know enough.
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
