4

I am running Ubuntu Linux, and am having some major system issues (networking not working, etc), which I think could be based on this fundamental problem.

When I try execute a variety of basic commands (including ps, ls, ifconfig, locate), I receive the error 'no such file or directory'.

Here are some suggestions that I've found online, that I have tried without success:

  1. I did a 'whereis ps' and found the file in the /bin/, and have checked that '/bin' appears when I do 'echo $PATH'
  2. I did a filesystem check which showed my hard drive as being clean
  3. I tried doing a 'sudo chmod 777 ps' but was told that I dont have permission. I don't think permissions for these files would have changed though (and I can't check as I can't run the 'ls' command).

Any help would be highly appreciated.

Improve this question
5
  • /usr/bin/ldd /bin/ls
    – Erik
    May 4, 2011 at 9:35
  • To try any command (I use ls in my example) you can try to do a whereis ls and try to execute it using the full path, like /bin/ls.
    – pconcepcion
    May 4, 2011 at 9:37
  • 1
    Maybe you are using some restricted shell? what is the output of echo $SHELL?
    – Carlos Campderrós
    May 4, 2011 at 10:27
  • What exactly is the output of echo $PATH
    – mmmmmm
    May 4, 2011 at 11:19
  • cd into the directory and then prefix the command with an ./; i.e. cd /bin; ./ps.
    – LawrenceC
    May 4, 2011 at 17:31

3 Answers 3

Reset to default
1

To cut a long story short, it looks like I was rooted by SHV4 / SHV5 rootkit. I will soon be formatted and reinstalling my box.

For future reference though, I was able to fix the file permissions by changing the file attributes (chattr -ais <filename>) and then changed the file owner back to root. The files were infected anyway though.

Thanks to all for you help and suggestions

Improve this answer
3
  • How did you discover that? Could you please add some details?
    – Mr. Shickadance
    May 5, 2011 at 13:35
  • 3
    After I changed the attributes and ownership of the infected files, I still couldn't execute them and that's when I realized that something else was going on. I noticed that the owner of the infected files (before I changed it) was '122' so I started Googling, found articles on the SHV4 / SHV5 rootkit, and noticed that all the files it infects (ps, ls, netstat, ifconfig, find, top, etc) were the ones with that owner.
    – Antony
    May 6, 2011 at 7:38
  • Well, at least you identified it. Thanks for the follow-up.
    – Mr. Shickadance
    May 6, 2011 at 13:48
0

In many cases your default user (non-root) is restricted and, as such, basic commands require that you enter the absolute path to the command.

Alternatively, you can edit your own .bash_profile (or .profile, depending upon distro) file in your home directory and add: 

PATH=/bin:/sbin:/otherdirectoryyouwanttoadd

Log out and log back in for the changes to take effect.

Improve this answer
0

If sudo doesn't give you the ability to chmod, one suspects either a weird security setup (e.g. incorrectly applied ACLs) or that your system has been taken over by someone who doesn't want you fixing things and has locked your (and probably the legit root) accounts out of doing anything.

Try booting it off a LiveCD (like the Ubuntu install CD) made on another box.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .