The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

/usr/local/bin/R ?

Discussion in 'General Discussion' started by noimad1, Sep 17, 2009.

  1. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    I was looking through the /usr/local/apache/error log on one of my servers and I'm seeing this:

    sh: /usr/local/bin/R: No such file or directory

    Any ideas on how I can find out what or who is trying to call this script?
     
  2. MattCurry

    MattCurry Well-Known Member

    Joined:
    Aug 18, 2009
    Messages:
    275
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Houston, Tx
    /usr/local/bin/R

    Hello,

    I do see how that could be concerning, please post just before and after this error from the log, this will give us a better picture of what is happening.

    Thank you,
    Matthew Curry
     
  3. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    Well unfortunetly there isn't much before or after. An it always seems to be different. Here is one group:



    [Fri Sep 18 13:08:12 2009] [error] [client 72.208.37.233] File does not exist: /home/customer/public_html/modules/tableso<table><tr><td><![endif]--><div class="select_sub"><ul class="sub"><li><a href="/newsletters.php" title="Newsletters Home">Newsletters Home</a></li><li><a href="/newsletters.php
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    [Fri Sep 18 13:08:20 2009] [error] [client 66.249.65.60] (2)No such file or directory: File does not exist: /home/customer/public_html/valuations_print.php
    [root@server:/usr/local/apache/logs]$





    Here is another group:


    [Fri Sep 18 11:15:58 2009] [error] [client 174.112.80.195] File does not exist: /home/customer/public_html/customer/modules/menu/side_menu3_2.css
    [Fri Sep 18 11:15:58 2009] [error] [client 174.112.80.195] File does not exist: /home/customer/public_html/customer/modules/menu/top_menu/customer5_2.css
    [Fri Sep 18 11:16:00 2009] [error] [client 66.249.65.60] File does not exist: /home/customer/public_html/forum/read.php?3,32788
    [Fri Sep 18 11:16:16 2009] [error] [client 207.214.127.6] File does not exist: /home/customer/public_html/notified-NotifyUser-ConnectingToInternetWarning
    [Fri Sep 18 11:16:16 2009] [error] [client 207.214.127.6] File does not exist: /home/customer/public_html/verify-NotifyUser-ConnectingToInternetWarning
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    sh: /usr/local/bin/R: No such file or directory
    [Fri Sep 18 11:16:37 2009] [error] [client 220.133.153.169] File does not exist: /home/customer/public_html/favicon.gif
     
  4. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    I know I don't have much information on this, but do you guys have any other suggestions on where to look?
     
  5. UNIXy

    UNIXy Well-Known Member

    Joined:
    Sep 21, 2009
    Messages:
    75
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Houston, Texas, USA
    cPanel Access Level:
    DataCenter Provider
    As Matthew, it does look like you need to have a good server admin look at your server. The error means that someone could have possibly used a vulnerability in one of your script to attempt to launch a program called "R." While the error shows that the attempt was unsuccessful, a successful run of the program R will not show in those logs.

    I would definitely get the server checked out. To inspect the content of the file. Run this:

    Code:
    updatedb
    Then

    Code:
    locate R
    Open the file R for inspection.

    Regards
     
  6. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    Thanks for the info...."locate R"....that should be fun....lol
     
  7. noimad1

    noimad1 Well-Known Member

    Joined:
    Mar 27, 2003
    Messages:
    627
    Likes Received:
    0
    Trophy Points:
    16
    Since the locate R really wasn't any help at all I decided to grep through the customers files (since they really only have one main site on the server).

    I found three files that reference the "R" program. I'm looking now into what they are trying to accomplish.

    It looks like the "R" program is originally designed to deal with graphs in someway.
     
  8. UNIXy

    UNIXy Well-Known Member

    Joined:
    Sep 21, 2009
    Messages:
    75
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Houston, Texas, USA
    cPanel Access Level:
    DataCenter Provider
Loading...

Share This Page