Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In the root of several of our old CentOS machines (CentOS release 5.8 (Final)) In the root of the ext3 file system I see the following:

wtf.

I've removed some of these, but they seem to continue coming back.

Here are the timestamps

-rw-rw----   1 root   root       0 2011-12-15 01:20 .?????????????????????????????????????????????????Z]Y?+
-rw-rw----   1 root   root       0 2011-12-16 01:14 .???????????????????????????????????????????????????ֽ*
-rw-rw----   1 root   root       0 2011-12-20 01:20 .?????????????????????????????????????????????????????*
-rw-rw----   1 root   root       0 2011-12-22 01:23 .??????????????????????????????????????????????????\X?*
-rw-rw----   1 root   root       0 2011-12-26 01:20 .????????????????????????????????????????????????????]+
-rw-rw----   1 root   root       0 2012-01-01 01:16 .?????????????????????????????????????????????????*???+
-rw-rw----   1 root   root       0 2012-01-04 01:15 .?????????????????????????????????????????????????????*
-rw-rw----   1 root   root       0 2012-01-11 01:14 .???????????????????????????????????????????????????;?+
-rw-rw----   1 root   root       0 2012-01-12 01:17 .?????????????????????????????????????????????????ZF.?*
-rw-rw----   1 root   root       0 2012-02-29 01:16 .?????????????????????????????????5?;J+
-rw-rw----   1 root   root       0 2012-02-29 01:17 .???????????????????????????????????e?*
-rw-rw----   1 root   root       0 2012-03-01 01:16 .??????????????????????????????????B)Q+
-rw-rw----   1 root   root       0 2012-03-06 01:08 .??????????????????????????????????'??+
-rw-rw----   1 root   root       0 2012-03-07 01:09 .?????????????????????????????????%?F?+
-rw-rw----   1 root   root       0 2012-03-22 01:07 .?????????????????????????????????%??+
-rw-rw----   1 root   root       0 2012-04-06 01:12 .?????????????????????????????????????*
-rw-rw----   1 root   root       0 2012-05-06 01:16 ??X?7+.?????????????????u{?7+
share|improve this question
    
do these machines with the odd filenames have a direct connection to the internet? –  Mike Pennington Jul 16 '12 at 20:27
    
@MikePennington Yes –  Marco Ceppi Jul 16 '12 at 20:33
    
Can you tell me what PermitRootLogin is set to in /etc/ssh/sshd_config? –  Mike Pennington Jul 16 '12 at 20:36
1  
Possible duplicate of serverfault.com/questions/218005/… ? :) –  Aaron Copley Jul 16 '12 at 20:41
    
I don't think we're being attacked, SSH port is locked outside of our network. So I'm not worried about PermitRootLogin –  Marco Ceppi Jul 16 '12 at 20:45

2 Answers 2

Those seem to appear approximately the same time at near 01:10. Could there be a buggy cron job creating those files?

share|improve this answer

Hmmm. Are you running rsyslog / syslog-ng ... or any other logging daemon ? I bet that it's a rule running wild. If you are using rsyslog check working directory and your rules.

Also you can try with lsof and if you are lucky the descriptor will be still alive and you will find the corresponding app.

share|improve this answer
    
Care to detail how I can lsof a file name like that? –  Marco Ceppi Jul 16 '12 at 23:23
    
@MarcoCeppi Go with find / -maxdepth 1 -type f -exec lsof {} + –  DerfK Jul 16 '12 at 23:29
    
Yields no results –  Marco Ceppi Jul 17 '12 at 16:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.