From owner-freebsd-security  Wed May  1  0:31:48 2002
Delivered-To: freebsd-security@freebsd.org
Received: from pooh.noc.u-net.net (pooh.noc.u-net.net [195.102.252.112])
	by hub.freebsd.org (Postfix) with ESMTP id 51C0C37B405
	for <freebsd-security@freebsd.org>; Wed,  1 May 2002 00:31:43 -0700 (PDT)
Received: from pooh.noc.u-net.net ([195.102.252.112] helo=there)
	by pooh.noc.u-net.net with smtp (Exim 3.22 #1)
	id 172oa7-000AaY-00; Wed, 01 May 2002 08:31:19 +0100
Content-Type: text/plain;
  charset="iso-8859-1"
From: Peter McGarvey <pmcgarvey@vianetworks.co.uk>
Reply-To: pmcgarvey@vianetworks.co.uk
Organization: VIA NETdotWORKS
To: Bill Fumerola <billf@elvis.mu.org>, Bill Fumerola <billf@mu.org>,
	pr0ject <el_kab0ng@texas-shooters.com>
Subject: Re: newbie.  possibly got hacked.  need help.
Date: Wed, 1 May 2002 08:31:18 +0100
X-Mailer: KMail [version 1.3]
Cc: freebsd-security@freebsd.org
References: <F26PHDXE2sCRBHZXFZ00000c2f7@hotmail.com> <20020430232953.A72277@mail.texas-shooters.com> <20020501044517.GF688@elvis.mu.org>
In-Reply-To: <20020501044517.GF688@elvis.mu.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <E172oa7-000AaY-00@pooh.noc.u-net.net>
X-Scanner: EQUS 136290b73cd1c3aea95e8b676f54204b (Personal POOH - SMTP Gateway)
X-EXIM-FILTER: PASS-s02
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wednesday 01 May 2002 05:45 am, Bill Fumerola wrote:
> On Tue, Apr 30, 2002 at 11:29:53PM -0500, pr0ject wrote:
> > hate to say it, but if you've removed something huge or you have a
> > runaway process holding the memory space, you might try rebooting.
>
> rebooting? stay away from my systems. try just installing 'lsof' (in a
> ports collection near your) and see whats holding open the file.

Hmm, installing a port whem /var is full does not strike me as a good idea.

I've seen a similar thing twice, turns out qmail goes haywire if you've 
got softupdates turned on.  The only way to fix it is to reboot into 
single-user mode and fsck the disk.  Remembering to turn softupdates off 
when it's finished.

Another fun way to fill a volume is to delete a log file.  Syslog will 
happily backfill your volume without complaint until you HUP or restart it.

-- 
TTFN, FNORD

Peter McGarvey
System Administrator
Network Operations, VIA Networks UK

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message