From owner-freebsd-security  Wed Aug 25 18:40:35 1999
Delivered-To: freebsd-security@freebsd.org
Received: from alcanet.com.au (border.alcanet.com.au [203.62.196.10])
	by hub.freebsd.org (Postfix) with ESMTP id CC0F015C1F
	for <freebsd-security@FreeBSD.ORG>; Wed, 25 Aug 1999 18:40:24 -0700 (PDT)
	(envelope-from jeremyp@gsmx07.alcatel.com.au)
Received: by border.alcanet.com.au id <40335>; Thu, 26 Aug 1999 11:38:51 +1000
Date: Thu, 26 Aug 1999 11:39:57 +1000
From: Peter Jeremy <jeremyp@gsmx07.alcatel.com.au>
Subject: Re: undelete
In-reply-to: <16996.935618248@localhost>
To: uldisk@kb.lkb.bkc.lv
Cc: freebsd-security@FreeBSD.ORG
Message-Id: <99Aug26.113851est.40335@border.alcanet.com.au>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

"Jordan K. Hubbard" <jkh@zippy.cdrom.com> wrote:
>> User, who was admin, and had wheel group,
>> deleted /bin;  /etc;  /var directories from my FreeBSD 3.1.
...
>No, you should simply reinstall them from a FreeBSD bin distribution

It's worth point out that it isn't quite this simple.  For /bin it'll
work.  In /etc, you'll need to go through and reconfigure most of the
files (though for a simple setup, this should be limited to rc.conf,
fstab, hosts, group, resolv.conf, exports and aliases).  When you're
rebuilding /etc/group, remember to leave that user out of wheel :-).

/var is the most serious.  Basically all you'll get out of the
distribution is a set of empty directories.  The contents are
virtually all system dependent.  In particular, you'll have lost
records of what packages (if any) you've installed, users' mail
(including any queued mail), games scores, cron jobs, at jobs,
accounting information, backups of most of the critical files
from /etc, etc.

If someone would like to fix LFS so it works, creating an `undelete'
command becomes much simpler...

Peter


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message