User Homes Disappearing

[AdamK]

Hi,

I work at a school and we are having a problem where users home directories are randomly disappearing. Here is some background information on what is happening:

Our system is K12 LTSP 4.2 with Fedora 6 and we have roughly 900 users. A few months back our NIS/NFS server died so we setup our backup server to take over. About a month after a few users directories would just disappear. Luckily we have a backup NAS which I use to restore the deleted directories so at the most they lose a days work!

Originally I assumed it was kids being kids and they were deleting each others homes. I assumed that their method to do this would be to find out someone’s password, log on and go to the main home directory, right click that users home folder and change the permissions to 777. Allowing them to access it from any user account and do what ever they wished.

So I wrote a script to check users permissions a couple times a day and I would then change permissions to 700 when needed. However, this didn’t solve the problem, users homes were still disappearing. Then to confuse me even more, I restored a users home directory on a Friday evening and then decided to check it again on Monday morning and it had gone again, no one had been in over the weekend and I'm in before any of the kids get to school.

So now every time I get another deleted home I recreate that kid a new account and then send all their work to the new account and that has seemed to solve the problem for that particular account.

On average I am getting about 4 students a day coming in with this problem and I honestly don’t know where to being to resolve this problem, especially as I have only being using Linux properly for the past 7 months.

I would greatly appreciate it if I could get some help with this. Is there a way I could check to see if a student was doing this? Are there any other reasons why this could be happening?

Thank your in advance and sorry for the essay.

Adamk

[sidebrnz]

Change the root password. If there's anybody other than you who needs it, let them know by email that it's been changed but not the new one. Tell them that you'll only give it to them in person. I don't know if somebody's been playing games with root, but if so, this is the best way to correct it.

[JohnVV]

if it is not someone " having fun" with a stolen root pass then how about the system backup
dose the # of users $HOME equal the # of students in the sys.
does the backup match the working system?
What AV is installed ,it might be deleting folders like they do in Windows.
have you been keeping track of the userid's of the missing $HOME 's maybe there is a pattern ?

[AdamK]

There are only a couple of us that have the root password and knowning the kids at the school I am at, if they knew the root password they would do more than delete a couple random users per day, eitherway I will change it and see what happens.

I will have a look at the userid's on monday, saying that though, 90% of the users that have had these problems are of the same year group, so would of been put on the system at the same time. I will also take a closer look at the backup as I never set that up, but I cant see that being the cause as its only a few accounts being affected, I would expect alot more problems if that was the cause.

Thanx for the help so far.

AdamK

[JohnVV]

my thinking on the u-id was " maybe " the system db has a bug and loosing uid's 1024,1025,1026 , or just 512,1024 ,2048 -- see the pattern.

but that is a zebra and most likely we are looking for a horse and not a zebra .
and with the back up .Is it possible that there in not enough room on that partition of the disk or the tape drive is to small? or the "dd" command is incorrect?
--------------- edit------------
scratch the above
you said that 905 are from the same group( that is year) and were put in at the same time .
So those students should be on the same drive on the server , or the same partition on that drive .
have you checked for bad sectors ?
It is possible the drive is going bad .

[AdamK]

Yea the majority of the users that it is happening to is of the same year group.

Every single user is on the same drive and partition and there is still about 50GB left of space.

I havent checked the drive for bad sectors. Will add that to the list of things to check on Monday

AdamK