rkhunter found this...

[Aaron Konstam]

On Thu, 2009-03-26 at 19:07 -0700, Daniel B. Thurman wrote:
> Daniel B. Thurman wrote:
> > Mikkel L. Ellertson wrote:
> >> Rick Stevens wrote:
> >>  
> >>> Do NOT ignore it.  I don't think you quite understand what /dev/null
> >>> is.  It is supposed to be a device, not a file.  Somehow it got deleted
> >>> and now whenever a script or something does a redirect of its output to
> >>> /dev/null, instead of going to a device (and thence into the bit
> >>> bucket), it creates a file called /dev/null.
> >>>
> >>>     
> >> What the OP found was /dev/nul - one l. I suspect that /dev/null was
> >> still there.
> >>
> >>  
> >>> To fix it:
> >>>
> >>> 1. Do an "ls -Z /dev/null" and make sure there is no _regular_ file,
> >>> directory, symlink, pipe or anything else called "/dev/null".  Check 
> >>> the
> >>> first character of the permissions.  If it's anything other than a "c"
> >>> then delete the file (you may need to do an "rm -rf /dev/null" to kill
> >>> it).
> >>>
> >>> 2. As root, run "MAKEDEV -x null".  That should recreate the device
> >>> file.
> >>>
> >>> 3. Run "ls -Z /dev/null" again and you should see something like:
> >>>
> >>> crw-rw-rw-  root root system_u:object_r:null_device_t:s0 /dev/null
> >>>
> >>> displayed.  If the first character of the permissions is NOT a "c", it
> >>> didn't work.
> >>>
> >>>     
> >> If he is running a fairly modern system - one that uses the dev file
> >> system, and/or runs udev, then udev will re-create it when the
> >> system reboots. In this case, it /dev/null is really gone, it is
> >> probably the safest way for hte OP to fix it...
> >>
> >> Mikkel
> >>   
> > Sigh.  I should have pointed out that my /dev/null is a device (I knew 
> > that!)and
> > it is unmolested!
> >
> > My device /dev/null IS as Mikkel said:
> > crw-rw-rw-  root root system_u:object_r:null_device_t:s0 /dev/null
> >
> > Instead, there is a TEXT file created: /dev/nul  (one "l") and rkhunter
> > reported it's suspicions correctly.
> >
> > I do NOT have any scripts that I have created (I only have
> > TWO scripts in my home/bin and I looked with a fine-toothed
> > comb.  It is not ME that created the /dev/nul (one "l")
> >
> > Somewhere, the SYSTEM (script or program) is creating it.
> >
> > The "clue" I left was:
> > =======[/dev/nul]=========
> > # more /dev/nul
> > nsdc: no patch necessary.
> > ^^^^^^^^^^^^^^^^^^^^
> > ========================
> >
> > For fun,  I looked at: /etc/init.d/nsd and there was code
> > in two places that had: 2>%1 (a stderr redirect?) and I suspected
> > it was intended to be: 2>&1?  I was not sure the % was
> > something I have seen before - this does not exists in the
> > entire /etc/init.d directory except for nsd!  Bug????
> >
> > Thanks!
> > Dan
> >
> I also found the same problems in:
> /etc/cron.hourly/nsd
> 
> There are three places where the same 2>%1 appears
> but ALSO there is that /dev/nul (one "l") !!!
> 
> Now, the question I have is: is 2>%1 a valid redirect
> string?  If not, then it is only the cron script in 3 places
> but if it is not, then there are 5 places, two in init.d and
> three in the cron script.
> 
> Thanks!
> Dan
> 
No, it should be 2>&1
--
=======================================================================
People with narrow minds usually have broad tongues.
=======================================================================
Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam at sbcglobal.net