Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Long story short, I've got an Ubuntu server box that was recently compromised (I believe through a known exploit of an older version of Tomcat, which has already been updated). Part of the exploit set the permissions on pretty much everything to 777.

In attempting to fix the incorrect permissions I inadvertently set /lib to 644 instead of 755 as it should have been. As a result of this, no programs can be run (including but not limited to chmod), and the system cannot fully boot (either normally or into recovery mode).

Is there any way to gracefully recover from this mistake, or do I basically have to reinstall Ubuntu from scratch at this point?

The one thing I can do is access a limited command prompt through grub. Using this I can browse the machine's filesystem, but I haven't found any way to use it to modify any permissions. Is there a a way to do this using grub's command prompt?

share|improve this question
    
Apart from that: Lib should have 755, not 644. -> unix.stackexchange.com/questions/21251/… –  Bonsi Scott Nov 25 '12 at 9:06
    
@BonsiScott, that's the whole reason for this question. –  cjm Nov 25 '12 at 16:49
2  
“I've got an Ubuntu server box that was recently compromised” → You need to do a full reinstall anyway. –  Gilles Nov 25 '12 at 20:39
    
@Gilles: Nothing like restoring from known good backups to make one feel better, eh? –  Scott Pack Nov 25 '12 at 20:47

1 Answer 1

up vote 8 down vote accepted

Well, you can recover from the permissions problem by booting a live CD/DVD/USB-drive, mounting your root filesystem (in a subdirectory), and running the chmod command there. SystemRescueCd is a distribution designed especially for this sort of repair, but any live CD that can handle your root filesystem will work.

But if your server has been compromised, it's very hard to be sure you've rooted out every trace of the compromise. The cracker could have left backdoors in surprising places. You're probably better off wiping the drive and reinstalling from scratch.

share|improve this answer
3  
+1 for reinstalling from scratch –  tjameson Nov 25 '12 at 10:04
    
+1 from me for the same reason. Installing from scratch is the best thing to do after such event. –  Bonsi Scott Nov 25 '12 at 13:34
    
I went for the full reinstall. But it's good to know that an alternative workaround was also possible. –  aroth Nov 25 '12 at 13:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.