1

I have a webserver which I log into over SSH. Recently, and I don't know what changed to cause this, any directory or symlink named "system" became invisible.

After SSHing into the server on the command line (Ubuntu terminal):

$ mkdir test_directory
$ cd test_directory/
$ ll
total 8
drwxr-xr-x   2 root     root         4096 Nov  7 18:02 ./
drwxr-xr-x   4 root     root         4096 Nov  7 18:02 ../
$ ln -s /var/www/repos/radiocms/admin/
$ ln -s /var/www/repos/radiocms/application/
$ ln -s /var/www/repos/radiocms/public/     
$ ln -s /var/www/repos/radiocms/system/
$ ll
total 8
drwxr-xr-x   2 root     root         4096 Nov  7 18:02 ./
drwxr-xr-x   4 root     root         4096 Nov  7 18:02 ../
lrwxrwxrwx   1 root     root           37 Nov  7 18:02 admin -> /var/www/repos/radiocms/admin//
lrwxrwxrwx   1 root     root           43 Nov  7 18:02 application -> /var/www/repos/radiocms/application//
lrwxrwxrwx   1 root     root           38 Nov  7 18:02 public -> /var/www/repos/radiocms/public//
$ cd /var/www/repos/radiocms/
$ ll
total 36
drwxr-sr-x   7 root     apache       4096 Nov  7 16:49 ./
drwxr-sr-x   9 root     apache       4096 Nov  7 16:49 ../
drwxr-sr-x   8 root     apache       4096 Nov  7 16:49 .git/
-rw-r--r--   1 root     apache          9 Nov  7 16:49 .gitignore
-rwxr-xr-x   1 root     apache        336 Nov  7 16:49 .htaccess*
drwxr-sr-x   7 root     apache       4096 Nov  7 16:49 admin/
drwxr-sr-x  10 root     apache       4096 Nov  7 16:49 application/
-rwxr-xr-x   1 root     apache       1363 Nov  7 16:49 index.php*
drwxr-sr-x   5 root     apache       4096 Nov  7 16:49 public/
$ cat /etc/*-release
CentOS release 6.4 (Final)
CentOS release 6.4 (Final)
CentOS release 6.4 (Final)
$ type ll
ll is aliased to `ls -alF --color=auto'
$ type ls
ls is aliased to `ls --color=auto'
$ which ls
alias ls='ls --color=auto'
    /bin/ls
$ which ll
alias ll='ls -alF --color=auto'
    /bin/ls
$ /bin/ls -al /var/www/repos/radiocms/
total 36
drwxr-sr-x   7 root     apache       4096 Nov  7 16:49 .
drwxr-sr-x   9 root     apache       4096 Nov  7 16:49 ..
drwxr-sr-x   8 root     apache       4096 Nov  7 16:49 .git
-rw-r--r--   1 root     apache          9 Nov  7 16:49 .gitignore
-rwxr-xr-x   1 root     apache        336 Nov  7 16:49 .htaccess
drwxr-sr-x   7 root     apache       4096 Nov  7 16:49 admin
drwxr-sr-x  10 root     apache       4096 Nov  7 16:49 application
-rwxr-xr-x   1 root     apache       1363 Nov  7 16:49 index.php
drwxr-sr-x   5 root     apache       4096 Nov  7 16:49 public

I know the symlink called “system” exists in the test directory: I just created it. I know the directory “system” exists in the “radiocms” directory, because the command line autocompleted for me when I was creating the symlink.

If I log in using Nautilus bookmarks (which uses SFTP), these directories show up just fine, but anything called “system” (folder, symlink to folder, or file) is invisible on the command line. What on Earth could be causing this? And how do I fix it?

If I then cd back to the test_directory, I get this:

$ ll
total 8
drwxr-xr-x   2 root     root         4096 Nov  7 18:02 ./
drwxr-xr-x   4 root     root         4096 Nov  7 18:02 ../
lrwxrwxrwx   1 root     root           37 Nov  7 18:02 admin -> /var/www/repos/radiocms/admin//
lrwxrwxrwx   1 root     root           43 Nov  7 18:02 application -> /var/www/repos/radiocms/application//
lrwxrwxrwx   1 root     root           38 Nov  7 18:02 public -> /var/www/repos/radiocms/public//
$ find . -maxdepth 1 -type l
./public
./application
./system
./admin

So find sees the symlinks, even if ls doesn't. I'm confused.

4
  • Try using the full syntax for creating symlinks with ln (ln -s /path/to/source /path/to/target). Also check the return code of ln to see if it's encountering an error.
    – voretaq7
    Nov 7, 2013 at 18:51
  • is it only directories called system? Is it in all paths? have you tried a different shell? Could the system possibly be compromised? are you trying as root?
    – Doon
    Nov 7, 2013 at 19:22
  • Trying as root, yes. Seems to be on all paths: certainly on everything I've tried under /var/www. Haven't tried a different shell. It's perfectly possible that the system is in some way compromised. @Doon.
    – TRiG
    Nov 18, 2013 at 11:00
  • We've since migrated to a new server, on the basis that the old one was hacked. (This wasn't the only sign of it, just the first.) So that's what the problem was. system is visible again, which is nice.
    – TRiG
    Jan 7, 2014 at 16:42

2 Answers 2

0

If you say that only the command line hide "system" elements, that should be related to the commands you use.

here, I see you only use ll to display folder, which is most of the time an alias. You can see what's the real command called by typing type ll. For example, I can see on my desktop :

type ll
ll is aliased to `ls -Al'

After what, you can try also check ls

type ls
ls is aliased to `ls --color=auto'

To be sure that the "shell" is the one not showing the folders, try using the real full path of the binaries :

/bin/ls -al /var/www/repos/radiocms/

And paste us the results of this command

Adrien.

4
  • That info has been added to the question, @Adrien.
    – TRiG
    Nov 8, 2013 at 11:46
  • Thats kind of... interesting :o can you run also this command: find . -maxdepth 1 -type l From what I see, the issue is either on the sshd, either on your Shell. If none, please try a rootkit finder like rkhunter
    – Adrien M.
    Nov 12, 2013 at 12:39
  • Added to question. I can see the system symlink with find, but not with ls.
    – TRiG
    Nov 12, 2013 at 13:09
  • Ok, there's definitely something wrong with your system. At least, the kernel seems not compromised, only your "ls" or your shell. Try with another shell. Try to reinstall the "coreutils" package : yum reinstall coreutils to ensure your /bin/ls binary was not modified.
    – Adrien M.
    Nov 12, 2013 at 17:06
0

If something unexpected is happening, I find it helps to be more explicit with my commands:

ln -s /var/www/repos/radiocms/system /path/to/test_directory/system

Also, in the output that you posted, it looks odd to me that your symlinks end with '//'. You might want to delete and re-create those too following the example I gave above.

1
  • ls -al shows only single terminal slashes. ls -alF shows double.
    – TRiG
    Nov 12, 2013 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .