Subject: RE: Disappearing files.....[long, new case/infos]

From: Steve Freitas <[email-masked]>
Date: Wed, 6 Dec 2000 11:28:47 -0800

>These machines may have a
>security hole which has been compromized.

I had this problem, but boxes were not (to my knowledge) compromised. 
Plus, I'm dealing with only two users (me and my brother), there are only 
two valid shell accounts on the system (mine and root), and it's behind a 
MacOS-based NAT box (no shell, woohoo!) with only SSH allowed in.

And if it were a hacker, I'd wonder why he deleted my brother's NOFX MP3s 
and left the rest alone... :-)

Steve

---

From: BWS - Offwhite <[email-masked]>
Date: Wed, 6 Dec 2000 14:09:47 -0600 (CST)

It sounds like the DID kludge may be a problem.  I am glad I am still
using an older version of Netatalk.  I typically stay away from releases
and wait till they mature a bit.

This could be why Linux seems to have hit hard by this.  The distros like
to get the latest goods out there.  The FreeBSD port is still an older
version which does not have this problem.

And if I do update I am going to be sure to set it to compile with the old
DID methods.  I do not even know what theese DIDs do, but it soudns like
the problem.

Brennan Stehling - web developer and sys admin
projects: www.greasydaemon.com | www.onmilwaukee.com | www.sncalumni.com

This signature is just here to take up space.

---

From: "Robert B. Bell" <[email-masked]>
Date: Wed, 06 Dec 2000 12:51:09 -0800

As someone else stated,
the problem is related to the volume id and inode number
mapping to the DID.
With "large" ext2 filesystems (>=2 or 4 GB), 
the number of inodes created by default is larger
than the number bits allocated to the DID by the inode number.

I think, but I am not sure, that the ext2 filesystem
does not reuse the inode right away,
or it doesn't allocate starting a 1 and continuing from there.
That causes the high inode numbers to be allocated also,
which means high inode number map with the mask
to a low inode number's DID.

You can view the number of inodes created by "df -i" on most unix/linux.

You can view the inode number of file by "ls -i file".

I believe if you keep the number of inodes less than the number that fits
into the DID mask, every will work ok.

  Robert.