Strange files on FTP account

up vote
0
down vote

favorite

We have a user who needs to use FTP for a specific application. For the last wee or so, really starnge files have been appearing in their account:

-rw------- 1 root       root          59 Nov 21 14:59 WZOBLx

-rw------- 1 root       root         108 Nov 21 14:59 x5yOLt

-rw------- 1 root       root          63 Nov 21 14:59 XcwBDS

They are all of the same format. The individual files cannot be moved copied or deleted - eg

rm: cannot remove 'WZOBLx': No such file or director

I am assuming that the server has been compromised in some way (running proftp)? Any suggestions (other than not to use ftp!_

asked Nov 21 at 4:04

skyman

1215

Check your ftp logs. Use ls -b to check for non-printing characters in the filenames. the (root,root) ownership is worrisome. Does your ftp user get logged in as root? If so, you have bigger problems.
– waltinator
Nov 21 at 16:16

No the user does not get logged in as root and in fact get chroot jailed. ls -b is a good idea..
– skyman
Nov 21 at 22:50

no - non printing characters. The home directories are on an nfs share so I guess their could be an nfs issue? ssh was also enabled - shutdown now
– skyman
Nov 21 at 22:52

add a comment |

up vote
0
down vote

favorite

We have a user who needs to use FTP for a specific application. For the last wee or so, really starnge files have been appearing in their account:

-rw------- 1 root       root          59 Nov 21 14:59 WZOBLx

-rw------- 1 root       root         108 Nov 21 14:59 x5yOLt

-rw------- 1 root       root          63 Nov 21 14:59 XcwBDS

They are all of the same format. The individual files cannot be moved copied or deleted - eg

rm: cannot remove 'WZOBLx': No such file or director

I am assuming that the server has been compromised in some way (running proftp)? Any suggestions (other than not to use ftp!_

asked Nov 21 at 4:04

skyman

1215

Check your ftp logs. Use ls -b to check for non-printing characters in the filenames. the (root,root) ownership is worrisome. Does your ftp user get logged in as root? If so, you have bigger problems.
– waltinator
Nov 21 at 16:16

No the user does not get logged in as root and in fact get chroot jailed. ls -b is a good idea..
– skyman
Nov 21 at 22:50

no - non printing characters. The home directories are on an nfs share so I guess their could be an nfs issue? ssh was also enabled - shutdown now
– skyman
Nov 21 at 22:52

add a comment |

up vote
0
down vote

favorite

We have a user who needs to use FTP for a specific application. For the last wee or so, really starnge files have been appearing in their account:

-rw------- 1 root       root          59 Nov 21 14:59 WZOBLx

-rw------- 1 root       root         108 Nov 21 14:59 x5yOLt

-rw------- 1 root       root          63 Nov 21 14:59 XcwBDS

They are all of the same format. The individual files cannot be moved copied or deleted - eg

rm: cannot remove 'WZOBLx': No such file or director

I am assuming that the server has been compromised in some way (running proftp)? Any suggestions (other than not to use ftp!_

asked Nov 21 at 4:04

skyman

1215

We have a user who needs to use FTP for a specific application. For the last wee or so, really starnge files have been appearing in their account:

-rw------- 1 root       root          59 Nov 21 14:59 WZOBLx

-rw------- 1 root       root         108 Nov 21 14:59 x5yOLt

-rw------- 1 root       root          63 Nov 21 14:59 XcwBDS

They are all of the same format. The individual files cannot be moved copied or deleted - eg

rm: cannot remove 'WZOBLx': No such file or director

I am assuming that the server has been compromised in some way (running proftp)? Any suggestions (other than not to use ftp!_

security ftp

asked Nov 21 at 4:04

skyman

1215

asked Nov 21 at 4:04

skyman

1215

asked Nov 21 at 4:04

skyman

1215

asked Nov 21 at 4:04

skyman

1215

asked Nov 21 at 4:04

skyman

1215

Check your ftp logs. Use ls -b to check for non-printing characters in the filenames. the (root,root) ownership is worrisome. Does your ftp user get logged in as root? If so, you have bigger problems.
– waltinator
Nov 21 at 16:16

No the user does not get logged in as root and in fact get chroot jailed. ls -b is a good idea..
– skyman
Nov 21 at 22:50

no - non printing characters. The home directories are on an nfs share so I guess their could be an nfs issue? ssh was also enabled - shutdown now
– skyman
Nov 21 at 22:52

add a comment |

Check your ftp logs. Use ls -b to check for non-printing characters in the filenames. the (root,root) ownership is worrisome. Does your ftp user get logged in as root? If so, you have bigger problems.
– waltinator
Nov 21 at 16:16

No the user does not get logged in as root and in fact get chroot jailed. ls -b is a good idea..
– skyman
Nov 21 at 22:50

no - non printing characters. The home directories are on an nfs share so I guess their could be an nfs issue? ssh was also enabled - shutdown now
– skyman
Nov 21 at 22:52

Check your ftp logs. Use ls -b to check for non-printing characters in the filenames. the (root,root) ownership is worrisome. Does your ftp user get logged in as root? If so, you have bigger problems.
– waltinator
Nov 21 at 16:16

No the user does not get logged in as root and in fact get chroot jailed. ls -b is a good idea..
– skyman
Nov 21 at 22:50

no - non printing characters. The home directories are on an nfs share so I guess their could be an nfs issue? ssh was also enabled - shutdown now
– skyman
Nov 21 at 22:52

add a comment |

active

oldest

votes

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1094696%2fstrange-files-on-ftp-account%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

active

oldest

votes

draft saved

draft discarded

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Cfxtrjtrk