[OpenAFS] Is anyone else seeing this:

[Jason Edgecombe]

Steve Devine wrote:
> All
> We are seeing a influx of spam laded web dirs in our afs cell.
> These are dirs that our main web server serve out of our cell for the
> students mostly.
> Here is a sample:
> http://www.msu.edu/~elizald2/viagra/order-viagra-overnight-delivery.html
> I have disabled it but you get the idea,. This dir is chock-o-block full
> of crap.
>
> I believe this is the work of a bot that arrives initially to the the
> user via a spam email.
> The bot then trolls through afs space (so the user is likely running
> windows with the client running) locates a user volume where the user
> has (foolishly) set system:anyuser to all acls and from there the bot
> can install anything it wants in the users web space and then send out
> spamage refering to this web space.
>
> Or this could be a compromised  web server with an afs client running on
> it.
>
> For now we are just trolling through our cell and looking for user dirs
> where system:anyuser = all and then taking appropriate action as needed.
>
> I hope to get my hands on a email that refers to this space so maybe I
> can track it back.
>
> Any thoughts?
> /sd
>
>   
We had a couple of these. Both users had system:anyser write or all 
priviledges on the public_html folder. Strangely, one of the user's home 
folder was system:anyuser none, so I'm guessing the user had disabled 
their web site at some point. We had to educate the other user. So far, 
we've only seen two users have these spam files.

Jason