3

I have configured some bind mounts on all users's home directories to access a shared directory (or parts of it) that is somewhere else in the file system, so I have entries like these on my fstab file:

/application/data/repository    /home/sergio/repository    none    bind
/application/data/repository    /home/mario/repository    none   bind
/application/data/repository/reports /home/carlos/reports    none    bind

Yesterday before I left the office all the binds where working as normal, however when I came to work today one of my users reported me that he couldn't access the shared folder. When I went into the server I discovered that all bind mounts were unmounted.

I went searching through the logs to see if there were any sign of someone else unmounting the bind mounts but nothing, the server did not reboot, no signs of intrusion attempts. No signs of errors in any of the log files.

I'm puzzled because I don't understand how can all the bind mounts get unmounted just like that. Just to be sure I changed all users's passwords and reviewed the firewall rules to make sure only authorized location have ssh access to the server.

Do you know of any reason for this? Any reason for the system to unmount the bind mounts?

I searched through the net but can find anyone reporting this kind of incident.

Sergio
  • 130
  • 4

1 Answers1

1

You should check the cron files for whatever is inside /etc/cron* and if any "sudoed" users got a cron inside /var/spool/cron/crontabs/ that could umount something.

autofs can also do stupide stuff with mount binds, but I've never seen it happen.

Vovor
  • 62
  • 3