I'm a system integrator(evidently noob), and today i've made my first scan with rkhunter, a tool that look into the system for check the presence of rootkits. After that scan i -foolishly- decided to remove the files inside /tmp/ directory, because rkhunter made some warning related to files inside it.
The sequence of commands i gave was :
cd /tmp/
ls
cd tracker-lese/
ls
ls -la
cd ..
rm * .
ls -la
rm -fr * /tmp/
Explaination : I was root, i mooved inside /tmp/ directory, i listed the content, I tryed to understand what was the content of tracker-lese/ directory, i went back to the /tmp/ directory, /!\ i did a rm * .
that i beleaved it did nothing(but maybe is where im missing understanding), and then i did a forced, recursive rm
After that impulsive operation , system began having troubles, and after reboot i could not login into the machine anymore.
Edit:
output of the command ls -ld /tmp/
drwxr-xr-x 6 root root 4096 Apr 8 19:19 /tmp/
rm * .
there. That's the root, chief.cd
command, which would ignore all but the first argument. Inserting;
into the most obvious places in that command would have you in the/
directory when executing therm
command. That would have wiped out the entire file system and not even let you log in.