How can this happen?

[Bruce Baillie]

I have a C110 HP-UX 10.20 whos only purpose is NIS server, NFS server, and application license server. No one actually works on this system. I just logged in and found the entire contents of the /etc directory also in the /home directory with all sub directories and symbolic links. The strange thing is the date and time is the same on everything, Jan 18 07:49. Could this be corruption? Should I just delete it all?

[Dan Hetzel]

Hi Bruce,

One thing is sure... It shouldn't be there !!

You may check with 'last' to see who was logged in at that time. The fact that all files and directories have the same timestamp isn't strange. As /etc is quite small doing a 'cp -r' wouldn't take longer than a minute.

Once you have investigated, it's safe to delete this directory.

Regards,

Dan

[Bruce Baillie]

Last shows a root login for 7 minutes in that time frame. cp will not copy the symbolic links. The way I copy symbolic links is through tar.

[Dan Hetzel]

Hi Bruce,

'cp' was an example. As you said, 'tar' would copy the links as would 'cpio -pdvulm'

Don't you have process accounting turned on? This would show which commands have been used by root at that time.

Dan

[Bruce Baillie]

Process accounting is not enabled. I removed everything that didn't belong and the system is still up. The /etc directory is intact so I guess no harm was done. Still very strange.

[John Bolene]

You can look at the .sh_history file for that user and see what commands they did. Maybe it was an innocent typo as I have done some really stupid things myself.