Hi Ingo, It was definitely b Oh my god!b :) I was shocked because I usually extract the source code.
Than, thanks to you I got my mind and realized that I did not extract the source code when I installed the box. It is one of my border routers, and I installed it during a b disasterb period, the old one is just R.I.P. sob& :) I have to be more careful when doing this. Thanks a lot, :) Best regards, Ivo > Hi Ivo, > > Ivo Chutkn wrote on Sun, Jan 18, 2009 at 09:43:06PM +0200: > >> I noticed strange thing on one of my OpenBSD 4.4 box. >> The directory /usr/src is empty except two patches I downloaded today >> and >> a file called Oops.rje. > > This is very funny, thanks for the good laugh! > > In German, the phrase "Herrje!" means "Oh my god!". > When you try to pronounce "rje", it sounds exactly like "Herrje". > Thus, "Oops.rje" is really nice. =:c) > > But, no more kidding, "Oops.rej" is a reject file written > by patch(1) when it cannot find the file to patch. For more details, > search the patch(1) manual page for the string ".rej". > >> The content of this file is at the end. >> I tried to apply security fix 007 and it ended with "File to patch:" >> Then I noticed that the /usr/src is empty. > > Well, patching source code you never installed will not work. > You should first extract the source tarball into /usr/src > before you start patching... > > Try to at least roughly understand the commands you are typing. > Otherwise, you will never have have a secure and very rarely > a working system... ;-( > >> Is it at all possible or someone broke in? > > Nobody can exclude that the box was broken in. > But the above does not contain any hint that there might have > been a break-in, so _probably_, the box is not compromised. > >> I receive daily output and did not notice any unknown or strange >> changes. > > Very probably, your attempt to patch non-existent source code > broke nothing. Just remove the contents of /usr/src, > install the sources from your CD set, and retry. > Also, have a look at > > http://www.openbsd.org/faq/faq10.html#Patches > > Yours, > Ingo
