[clug] Effects of hacking on md

[Martijn van Oosterhout]

Last time I had a md raid that it kept want to rebuild was when lilo
was mounting one of the physical partitions as the root partition but
linux was mounting the other md partitions fine. As a consequence the
two components of the md or the root fs got out of sync. Fine way to
ruin your day...

This problem is only really possible with mirroring, since half a
striped partition doesn't look like a valid filesystem. Don't trust
what /etc/fstab of /etc/mtab are telling you. Go through the dmesg
output and check that the right things are being mounted...

Hope this helps,

On Fri, Mar 04, 2005 at 01:32:47PM +1100, Michael James wrote:
> We're having major grief on a server
>  with md software raids rebuilding continuously.
> 
> I'm beginning to suspect attempts at hacking.
> 
> What would happen to a software mirror
>  if somebody tried to bust out of a chroot jail
>  by accessing the disks directly?
> They'd dirty the mirror and trigger a rebuild
>  wouldn't they?
> 
> And how does a mirror rebuild anyway?
> I mean, I have 2 pieces of data, they're different.
> Which is right?
> 
> It's all too much like a duck, only in this case,
>  one of its legs are both a bit different.
-- 
Martijn van Oosterhout   <kleptog at svana.org>   http://svana.org/kleptog/
> Patent. n. Genius is 5% inspiration and 95% perspiration. A patent is a
> tool for doing 5% of the work and then sitting around waiting for someone
> else to do the other 95% so you can sue them.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
Url : http://lists.samba.org/archive/linux/attachments/20050304/08bc5143/attachment.bin