[lug] Weird directory in users home dir

[bdoctor at ps-ax.com]

You can issue the command "find ." from the user's directory to see what is 
in this sub directory, and others.  If you need to remove it or cwd to it, 
try using a quote with leading spaces, then press tab, which should complete 
the path, otherwise something like this:

cd "  /"<enter>

rm -rf "  /"<enter>

Looks like there are two spaces or so leading up to it.
-brad


[Charset iso-8859-1 unsupported, filtering to ASCII...]
> I ran across this oddity while searching for a suspected cracker on my 
> shell server. The users home directory has a directory / in it which if 
> cd'd to will go to the root directory. It is not a link or anything, 
> but it looks like it might have a space or two in front of it. I'm 
> afraid to delete this directory or the users account directory in case 
> it has been booby trapped somehow. Any ideas?
> ------------------------
> [root at oldschool long]# pwd
> /home/long
> 
> [root at oldschool long]# ls
>   /  README.jackmoves@  ftp@  mail/    #you can see the / dir here
> 
> [root at oldschool long]# ls -l
> total 8
> drwxr--r--   3 556      users        4096 Jun 16 19:28   /   #again
> lrwxrwxrwx   1 556      users          28 May 15 14:36 
> README.jackmoves -> /home/httpd/README.jackmoves
> lrwxrwxrwx   1 556      users          13 May 15 14:36 ftp -
> > /home/ftp/pub/
> drwx------   2 556      users        4096 May 15 14:36 mail/
> 
> [root at oldschool long]# ls -a
>   /  ../           .bash_profile  .screenrc          ftp@
> ./   .bash_logout  .bashrc        README.jackmoves@  mail/
> 
> [root at oldschool long]# cd    #i typed cd (tab) to list my dir options
>                   .bash_profile     .screenrc         ftp
> .bash_logout      .bashrc           README.jackmoves  mail
> #wierd thing above is that the dir showed as just spaces???
> 
> Could they have just touched this file named / and made it appear like 
> something bad? Thanks for any ideas...
> 
> Justin
> 
> 
> -----
> glow at jackmoves.com
> www.jackmoves.com
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>