[lug] Weird directory in users home dir

[Eric Kilfoil]

In Linux, ls by default will tack on a '/' to directories in an ls listing
to signify that their are directories.  This used to be an option to ls
(ls -F) to show file types, however, it appears to now be the default with
GNU ls.  Your directory is actually "  ", not "  /".  So issue the
command:

cd "  "

and you'll probably find yourself a nice collection of pirated software.
You can safely delete this directory by typing:

rm -ri "  "

It will prompt before deleting.

eric

On Tue, 19 Jun 2001, Justin wrote:

> I ran across this oddity while searching for a suspected cracker on my
> shell server. The users home directory has a directory / in it which if
> cd'd to will go to the root directory. It is not a link or anything,
> but it looks like it might have a space or two in front of it. I'm
> afraid to delete this directory or the users account directory in case
> it has been booby trapped somehow. Any ideas?
> ------------------------
> [root at oldschool long]# pwd
> /home/long
>
> [root at oldschool long]# ls
>   /  README.jackmoves@  ftp@  mail/    #you can see the / dir here
>
> [root at oldschool long]# ls -l
> total 8
> drwxr--r--   3 556      users        4096 Jun 16 19:28   /   #again
> lrwxrwxrwx   1 556      users          28 May 15 14:36
> README.jackmoves -> /home/httpd/README.jackmoves
> lrwxrwxrwx   1 556      users          13 May 15 14:36 ftp -
> > /home/ftp/pub/
> drwx------   2 556      users        4096 May 15 14:36 mail/
>
> [root at oldschool long]# ls -a
>   /  ../           .bash_profile  .screenrc          ftp@
> ./   .bash_logout  .bashrc        README.jackmoves@  mail/
>
> [root at oldschool long]# cd    #i typed cd (tab) to list my dir options
>                   .bash_profile     .screenrc         ftp
> .bash_logout      .bashrc           README.jackmoves  mail
> #wierd thing above is that the dir showed as just spaces???
>
> Could they have just touched this file named / and made it appear like
> something bad? Thanks for any ideas...
>
> Justin
>
>
> -----
> glow at jackmoves.com
> www.jackmoves.com
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>