Disappearing /var/named/pz

Hi,

I have a secondary DNS server (RH9 using ext3 FS) which suddenly one
day didn't want to serve DNS. So upon inspection I noticed that the
whole /var/named/pz directory is missing (this dir holds the zone
files)..... gone, poof, into blue air or cyberspace as it was...

???????
How is this possible? If there was a diskfailure or a powercut (likely)
then shouldn't ext3 be able to recover from this? How can a whole
directory just disappear? How can I ask ext3 to tell me what it thinks
it's doing?

Sorry if this is slightly OT.
Thanks!

Tobias Skytte

(E-Mail Removed) wrote:
> Hi,
>
> I have a secondary DNS server (RH9 using ext3 FS) which suddenly one
> day didn't want to serve DNS. So upon inspection I noticed that the
> whole /var/named/pz directory is missing (this dir holds the zone
> files)..... gone, poof, into blue air or cyberspace as it was...
>
> ???????
> How is this possible? If there was a diskfailure or a powercut (likely)
> then shouldn't ext3 be able to recover from this? How can a whole
> directory just disappear?

Did you reboot and forced an fsck?
Is there something in /var/lost+found ( /lost+found, depending how your
volumes are set up ) ?
At last, did you try chkrootkit?

Good Luck
Olivier

On 4 Sep 2005, (E-Mail Removed) <(E-Mail Removed)> wrote:
> I have a secondary DNS server (RH9 using ext3 FS) which suddenly one
> day didn't want to serve DNS. So upon inspection I noticed that the
> whole /var/named/pz directory is missing (this dir holds the zone
> files)..... gone, poof, into blue air or cyberspace as it was...
>
> ???????
> How is this possible? If there was a diskfailure or a powercut (likely)
> then shouldn't ext3 be able to recover from this? How can a whole
> directory just disappear? How can I ask ext3 to tell me what it thinks
> it's doing?

I lost /etc/sysconfig/SuSEfirewall2 one day and never did figure out how
(not during a reboot, but sometime between pppoe being dropped and
reconnecting on demand). I even went back through my .bash_history and
could find nothing to account for it (like accidental rm).

My guess is that you accidently moved or removed it. Although, I am also
guessing from the path that you are not running bind in a chroot jail, and
without knowing its version it may have been subject to an exploit. My
bind does not listen-on or allow-query from any public interfaces or IPs.