Author Topic: System folder links being deleted  (Read 313 times)

0 Members and 1 Guest are viewing this topic.

Offline
*
System folder links being deleted
« on: May 06, 2020, 06:43:53 PM »
Hey guys!

We are having some very strange problems, this has already happened on 3 CentOS servers with CWP installed, always updated in the latest versions.

It turns out that, simply without doing anything, without running out of disk space, without running anything, in the middle of the night, the links in the folders below disappear:
usr/sbin sbin
usr/lib lib
usr/lib64 lib64
usr/bin bin

We need to turn off the CentOS VPS, mount the disk drive in another directory, and give the command below so that they are recreated, then we disassembled the drive and managed to connect the VPS without problems.
ln -s usr/sbin sbin;ln -s usr/lib lib;ln -s usr/lib64 lib64;ln -s usr/bin bin

When the problem occurs, we are unable to access SSH or CWP Services, the IP continues to respond normally to the drip, but we are unable to access anything.

CentOS 7.6 64 Bit
CWPpro version: 0.9.8.970

Has anyone been through something like this? We don't have that kind of problem with other VPSs that we use without the CWP, so we thought about asking for help here in the group.

Offline
***
Re: System folder links being deleted
« Reply #1 on: May 06, 2020, 09:24:55 PM »
Can you check /etc/Cron.(daily,weekly) to see if there are any suspicious scripts. I've install Cwp at least 20 times and never seen this issue.
Google Hangouts:  rcschaff82@gmail.com

Offline
*
Re: System folder links being deleted
« Reply #2 on: May 07, 2020, 11:22:28 AM »
I didn't find anything unusual in the cron services.

This happened on 3 different servers, on different dates, we have 8 servers running CWP, 5 of them have not had this type of problem yet.

I don't know if anyone else has ever had something like this, but I wanted to know what it could be, I don't know if maldet thought it could be something malicious ... but I don't think in the logs.