[OpenAFS-devel] Client part of AFS server

Onime Clement onime@ictp.trieste.it
Sat, 26 Feb 2005 06:42:50 +0100 (CET)


I've seen this kind of behaviour on a compromised machine that had a
rootkit installed, especially the rootkits that use a kernel module to
hide their presence.
Sorry I cannot remember the exact name of the root kit as it was about 2
years ago.
I would suggest that you boot the machine with a clean/install CD in
rescue mode or and then examine it for rootkits or try md5sum comparison
of the kernel and other kernel modules.

Clement Onime

>When I start afsd, all SScall() return -1, which could mean the module is
>not loaded. However, the module loads OK, with no errors or warnings.

>The other two servers have the exact same kernel, the same kernel module,
>etc...

>I've looked in the list, but all similar problems are kernel module
>related.

>Can anyone give me an hint on what's going on?

>Thank you,

>Nuno Miguel Neves