Mysteriously Missing Main.asc

[Josh Hughey]

Have any of you ever heard of a main.asc file being "mysteriously" deleted from
an application's directory?

I'm working on a client project that was being developed on an in-house Fedora
Core 5 server where I'd installed FMS. I uploaded the client's video streams
and coded main.asc's for two separate applications. One of them, the larger of
the two, had some very important code in there that took me several all
nighter's to get right.

Long story short, the project got put on hold for a while and now I'm taking
another look at it, and moving it to a server live on the internet. In doing
so, I'm seeing that the main.asc file I wrote for one of the projects is just
plain GONE, like it never existed. The other application is fine, untouched,
but the more important of the two has another strange twist: a directory called
"http" that I never created. Inside it are some streams (placed in their own
subdirectories) from the application's "streams" directory that I never moved
in there. And of course like I said, the main.asc file is just plain gone.

Looking at /var/log/messages doesn't give me any information (looks like the
logs just rotated a day or two ago). Does anyone have any ideas how I can find
out:

a) how the hell this was deleted,
b) if there's a backup somewhere on the system (already tried updatedb/locate
main.asc, no help)
c) how to prevent it from happening again

Thanks in advance for any assistance you can provide.

[JayCharles]

I'm wondering if you've got some security holes there. Did you look at any of
the streams? Are they something that would have been published by an authorized
user, or does it appear that someone has been adding their own streams and
leeching your bandwidth/connections?

The missing main.asc is what makes me suspicious. FMS wouldn't remove its own
files like that, and since other files are where they should be, it sort of
rules out the file missing as a result of a system restore. Removing the
main.asc would make the application wide open to abuse, so if someone wanted to
leech effectively, removing the main.asc would be helpful to them.

What do your server logs (not the FMS logs, the network level logs) tell you?
Do you see anything odd? If someone broke into the server and deleted your
main.asc, it wouldn't show up in the FMS logs.

[Josh Hughey]

Hi Jay, thanks for replying.

As for a security break-in, I don't think that happened as this particular
server from which it's missing is firewalled from the outside world denying ALL
connections on ALL ports from anything except the local intranet. I'm with you
in thinking FMS wouldn't delete its own file, so I'm wondering if some process
on the system somehow did this (it's a Fedora Core 5 box). Only problem is,
the only logfile I know to check has already rotated it appears. I dug around
a few of the FMS logs and didn't see anything out of the ordinary there either.

Again, thanks for the reply. Any other ideas or thoughts?

[JayCharles]

Well.. the presence of that http dir makes me wonder a bit. FMS creates that
directory when the application makes an http request (like loadVars or
remoting). FMs might also do that when the application makes a netconnection to
another server, but I'm not 100% sure on that. Does you app use any loadvars or
remoting calls that would have cause FMS to create that directory? You
mentioned that there were some flv files in there... what's in them?
Audio/video, or just data?

[Josh Hughey]

Yes actually, my application makes calls to a web service that I coded in PHP.
It's been tested and seems to work fine without error (it's actually very
simple, not much code). There isn't anything inside each directory under the
http directory, just a bunch of empty directories that are the names of streams
I accessed to check the validity of the webservice through FMS.

So we know FMS created those directories. That's one thing I was worried
about, and now we know. Does that shed any light on how main.asc was deleted,
though?

Thanks again.

[JayCharles]

It's good to know the http dir and it's children are there for legitimate
reasons.

Short of human error, and attack on the server, or the server having been
restored from a previous backup, I can't come up with any ideas on the missing
main.asc file.

[Josh Hughey]

Thanks for your input Jay. The only conclusion I can reach is that it must
have been human error. I went through ~/.bash_history and did a search for
anything pertaining to main.asc, and found that instead of "cp" I used "mv" to
MOVE the file to another location. Unfortunately that location was cleaned out
a bit over a month ago, so the only copy of the file was deleted.

My primary concern was that FMS somehow did it, but now that we've ruled that
out, and now that I know how/why the http directory was created, I'm "OK" now.

Again, thanks for your help. I feel like an idiot but hey, ya know...gotta
lower my pride somehow ;-)