Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is a server running ubuntu 8.04 server, any idea what's going on?

# ls
-bash: /bin/ls: No such file or directory
# /bin/ls
-bash: /bin/ls: No such file or directory
# stat /bin/ls
  File: `/bin/ls'
  Size: 39696       Blocks: 80         IO Block: 4096   regular file
Device: 803h/2051d  Inode: 1073910881  Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (  122/ UNKNOWN)   Gid: (  114/Debian-exim)
Access: 2008-06-05 15:07:22.491486000 -0700
Modify: 2008-04-03 23:44:23.000000000 -0700
Change: 2009-05-21 07:42:45.715736917 -0700
#:/bin# dd if=/bin/ls of=/dev/null 
77+1 records in
77+1 records out
39696 bytes (40 kB) copied, 0.000157908 s, 251 MB

I have no idea how it got the weird GID and UID, neither one exists in /etc/passwd

I recently performed the ubuntu NTP update to fix a security hole.

Update: I just noticed /bin/netstat has the same issue

Update: looks like I got rooted, ran rkhunter and it found a kit...

share|improve this question
    
If you run "chown root:root /bin/ls" does that help the problem at all? –  gharper May 21 '09 at 17:23
    
Already did, no luck, I also ran chkrootkit, no positive results. –  Andrew Cholakian May 21 '09 at 17:27
    
When you ran chown root:root ... Did stat change so the owner and group was root? –  Kyle Brandt May 21 '09 at 17:35

4 Answers 4

up vote 11 down vote accepted

Having ls and netstat broke on a system sounds suspiciously like something a hacker would do to avoid detection. Usually they try to patch those tools to prevent detection of tools and backdoors they had installed or created. You might want to consider rebooting to a livecd and then checking the md5sums of those files.

If the system is compromised please check these questions for some advice on how to deal with the situation.

share|improve this answer

You can get the 'No such file or directory' error when the dynamic linker cannot find the appropriate shared objects.

Run:

ldd /bin/ls

and check the output.

Looks suspicious to me as well, by the way. I'd worry about your system having been compromised.

share|improve this answer
1  
ls is usually a shell built in. You should check that your shell not /bin/ls has been modified. –  Dave Cheney May 21 '09 at 18:31
    
@Dave Cheney: I don't think that bash (the default shell on Ubuntu) has a ls builtin. –  Cristian Ciupitu Jun 2 '09 at 20:52

Here's the output of stat /bin/ls on my Ubuntu 8.04 server. Different size, so I would guess the file has been corrupted or replaced.

# stat /bin/ls
  File: `/bin/ls'
  Size: 106176          Blocks: 216        IO Block: 4096   regular file
Device: ca00h/51712d    Inode: 3631        Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2009-05-21 13:31:51.000000000 -0400
Modify: 2008-04-04 02:44:23.000000000 -0400
Change: 2008-05-29 17:14:25.000000000 -0400
share|improve this answer

This isn't specifically related to your problem, but if a system doesn't have /bin/ls installed (i.e., someone has deleted it), you can use:

echo *
to get a directory listing. I have had to use this before, and it's a lifesaver.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.