Chaos on a Linux box!

[Amazator]

Hi guys,

Someone in my organisation who is high enough in the management chain has access to the root password on one of our servers and while writing some shell scripts, executed the command:

mv ${SOME_DIR}/* BKUP_<some date suffix>/

After that, no one's been able to login to that server through rsh or telnet. I suspect that he used a wrong variable value (there must've been no variable like SOME_DIR in his code).

Since it moved pretty much everything under the '/' to another directory, all the paths are haywire and nothing is working. Adding to that, he even closed that session in alarm. So the only hope of recovery is also gone with the wind.

Any tips on how to login to that system and remedy the situation by copying the / contents to their proper places?

Thanks a million!

 

[Ogzilal]

Hi,

Try to boot the box with a bootable CD and then backup what you can.

Sysadmin ( root access ) is a real and Full JOB, not somthing every one can practice at his lost moments.

 

[gregor weertman]

Can you attach the disk of that machine to another Linux box?

 

[sbrews]

Based on the command issued:

mv ${SOME_DIR}/* BKUP_<some date suffix>

I would say that ${SOME_DIR} equated to a blank (or null). So the actual commanded ended up being:

mv /* BKUP_<some date suffix>

so everything in / got moved to BKUP... hopefully BKUP... is a directory. If so, simply boot from an interactive cd (ie knoppix) mount the "broken" root disk and move everything from BKUP... back to /

scott

 

[ProbablyDown]

After you do Scott's recommendation, change the root password