DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2010-06-18 23:38:02

Headcase_Fargone
Member
Registered: 2009-11-06
Posts: 44

ffp/bin/sh?

It's me again, everyone's favorite Linux newbie.  I hope I'm not wearing out my welcome here asking so many questions, but honestly this has been the best resource I've found so far.

Recently I've been having to reboot my DNS-321 just about every day.  It becomes almost completely unresponsive.  I say almost because it takes a good five minutes to get telnet'ed into it, and another five or so to get a "top" running.  When I do, however, I notice that there are a dozen or more processes running called /ffp/bin/sh.  Each one eats 2% of the system's memory.  My suspicion is that more and more instances of this keep coming up until the system chokes.

Does anyone know what would cause that?

Edit: It seems this is preventing it from staying idle as well.  The drives are spinning up every time a new copy of that process gets kicked off.  Very annoying.

Last edited by Headcase_Fargone (2010-06-19 03:29:29)

Offline

 

#2 2010-06-20 02:51:09

Headcase_Fargone
Member
Registered: 2009-11-06
Posts: 44

Re: ffp/bin/sh?

This is really strange.  I'm sitting here watching "top" refresh and every minute or so another process kicks off.  If I leave it running for a while I come back to find the page filled up with the following:

7439  1777 root     S     1368   2%   0% /ffp/bin/sh
7567  1777 root     S     1364   2%   0% /ffp/bin/sh
7719  1777 root     S     1364   2%   0% /ffp/bin/sh
7523  1777 root     S     1364   2%   0% /ffp/bin/sh
7562  1777 root     S     1364   2%   0% /ffp/bin/sh
7715  1777 root     S     1364   2%   0% /ffp/bin/sh
7487  1777 root     S     1364   2%   0% /ffp/bin/sh
7662  1777 root     S     1364   2%   0% /ffp/bin/sh
7740  1777 root     S     1364   2%   0% /ffp/bin/sh
7664  1777 root     S     1364   2%   0% /ffp/bin/sh
7481  1777 root     S     1364   2%   0% /ffp/bin/sh
7696  1777 root     S     1364   2%   0% /ffp/bin/sh
7663  1777 root     S     1364   2%   0% /ffp/bin/sh
7716  1777 root     S     1364   2%   0% /ffp/bin/sh
7745  1777 root     S     1364   2%   0% /ffp/bin/sh
7669  1777 root     S     1364   2%   0% /ffp/bin/sh
7697  1777 root     S     1364   2%   0% /ffp/bin/sh
7710  1777 root     S     1364   2%   0% /ffp/bin/sh
7518  1777 root     S     1364   2%   0% /ffp/bin/sh

Is there a log somewhere I can check to see what's starting this?

Offline

 

#3 2010-06-25 04:21:51

Headcase_Fargone
Member
Registered: 2009-11-06
Posts: 44

Re: ffp/bin/sh?

Still having this issue.  It definitely has something to do with my telnetd.sh script.  Can someone post what it should look like?

This is what mine looks like right now:

#!/ffp/bin/sh

# PROVIDE: telnetd
# REQUIRE: LOGIN

. /ffp/etc/ffp.subr

name="telnetd"
command="/ffp/sbin/telnetd"
telnetd_flags="-l /ffp/bin/sh"

run_rc_command "$1"

Offline

 

#4 2010-06-25 09:47:21

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: ffp/bin/sh?

Headcase_Fargone wrote:

It definitely has something to do with my telnetd.sh script.

How do you know?

Offline

 

#5 2010-06-25 16:08:58

Headcase_Fargone
Member
Registered: 2009-11-06
Posts: 44

Re: ffp/bin/sh?

Last week I very stupidly removed the "-l /ffp/bin/sh" (in an attempt to get a login prompt for telnet access) and was no longer able to access root.  I manually re-added that line and at another member's advice was able to get fun_plug to overwrite the edited telnetd.sh file.  I got my access back, but that's precisely when this new issue presented itself.

It's definitely something that I've screwed up, I just can't for the life of me find what.

Last edited by Headcase_Fargone (2010-06-25 16:09:45)

Offline

 

#6 2010-06-25 17:00:14

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: ffp/bin/sh?

Can you make your fun_plug and telnetd.sh scripts available for download somewhere (not just copy and paste, but the real files)?

Offline

 

#7 2010-06-28 23:28:26

gasman
Member
From: Swansea,UK
Registered: 2009-06-23
Posts: 94

Re: ffp/bin/sh?

Headcase_Fargone wrote:

Still having this issue.  It definitely has something to do with my telnetd.sh script.  Can someone post what it should look like?

This is what mine looks like right now:

#!/ffp/bin/sh

# PROVIDE: telnetd
# REQUIRE: LOGIN

. /ffp/etc/ffp.subr

name="telnetd"
command="/ffp/sbin/telnetd"
telnetd_flags="-l /ffp/bin/sh"

run_rc_command "$1"

Here is mine

#!/ffp/bin/sh[LF]
[LF]
# PROVIDE: telnetd[LF]
# REQUIRE: LOGIN[LF]
[LF]
. /ffp/etc/ffp.subr[LF]
[LF]
name="telnetd"[LF]
command="/ffp/sbin/telnetd"[LF]
telnetd_flags="-l /ffp/bin/sh"[LF]
[LF]
run_rc_command "$1"[LF]
[LF]

I am a newbie myself and I had strange behaviour when I mistakenly edited a file using notepad. Now I use Notepad++ for nearly all my unix editing, making sure file is set as 'Convert to Unix format'.

I have added the [LF] characters myself to indicate the linefeed symbols. Make sure no [CR] symbols are present.

Hope this helps.


DNS-323 FW 1.08 (05/15/2009) HW:B1
2 * Seagate    ST3500630AS (500GB)  Fun_plug 0.5
DNS-323 FW 1.08  (12/18/2009) HW:B1
2 * Hitachi    HDS5C3020ALA632 (2TB)  Fun_plug 0.5

Offline

 

#8 2010-08-15 13:44:59

FunFiler
Member
Registered: 2010-05-23
Posts: 577

Re: ffp/bin/sh?

Sometimes, when I "exit" from telnet I find that the session doesn't end and I have to close telnet manually. When I do this, bin/sh is left in memory. Clearing then manually with "kill" or rebooting is the only solution.


3 * (DNS-323 with 2 * 2TB) = 12TB Running FW v1.08 & FFP v0.5
Useful Links: Transmission, Transmission Remote, Automatic

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB