FATAL: Kernel too old

FATAL: Kernel too old

[Richard B. Johnson]

Who decides that the kernel is too old? Can't log-in over the
network on a machine that has a lot of uptime. Telnet to the
mail-server does work, though. It's just that shells don't
seem to work anymore!!!

Script started on Fri Feb  6 15:44:32 2004
# rlogin -l johnson quark
ATAL: kernel too old
# rlogin -l johnson quark
ATAL: kernel too old
# telnet quark
Trying 10.106.100.200...
Connected to quark.analogic.com.
Escape character is '^]'.
FATAL: kernel too old
Connection closed by foreign host.
# ping quark
64 bytes from 10.106.100.200   icmp-seq:0  ttl:64  time(ms):3.53    lost:0
64 bytes from 10.106.100.200   icmp-seq:1  ttl:64  time(ms):0.25    lost:0
Aborted!
# rsh quark
ATAL: kernel too old
#
# telnet quark 25
Trying 10.106.100.200...
Connected to quark.analogic.com.
Escape character is '^]'.
220 quark.analogic.com ESMTP Sendmail 8.11.0.Beta3/8.12.0.A; Fri, 6 Feb 2004 15:51:27 -0500
^]
telnet> quit
Connection closed.

It wouldn't let me log in at the console either, got the "init spawing
too fast..." message. Nothing in the logs. It's a generic RH with
the Linux-2.4.18-14 that it came with, never been hacked and used
as an internal mail-forwarding machine. It's been up since, probably
last April.

I couldn't find that "FATAL:" string in /bin/bash, in any
/lib/libc* files, nor in vmlinux. It's in /bin/rpm and in
/bin/ash.static. These are not used to log-in (I hope).
It's also in a bunch of /sbin files, never used to log in
(like e2fsck).

I crashed it and it rebooted fine, little fsck activity, with
nothing in any logs that shows there was any problem whatsoever.

Cheers,
Dick Johnson
Penguin : Linux version 2.4.24 on an i686 machine (797.90 BogoMips).
            Note 96.31% of all statistics are fiction.

Re: FATAL: Kernel too old

[Charles Cazabon]

Richard B. Johnson <root@chaos.analogic.com> wrote:
> 
> Script started on Fri Feb  6 15:44:32 2004
> # rlogin -l johnson quark
> ATAL: kernel too old
> # rlogin -l johnson quark
> ATAL: kernel too old

I saw something similar at a customer's site, when someone rooted the box and
replaced the default login shell with a rootkitted/backdoored one in a newer
executable format not supported by the old kernel.

> I crashed it and it rebooted fine, little fsck activity, with
> nothing in any logs that shows there was any problem whatsoever.

Did the problem go away with a reboot?

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon                            <linux@discworld.dyndns.org>
GPL'ed software available at:     http://www.qcc.ca/~charlesc/software/
-----------------------------------------------------------------------

Re: FATAL: Kernel too old

[Frédéric L. W. Meunier]

On Fri, 6 Feb 2004, Charles Cazabon wrote:

> Richard B. Johnson <root@chaos.analogic.com> wrote:

Hmm, getmail's author doing this :-) ?

> > Script started on Fri Feb  6 15:44:32 2004
> > # rlogin -l johnson quark
> > ATAL: kernel too old
> > # rlogin -l johnson quark
> > ATAL: kernel too old
>
> I saw something similar at a customer's site, when someone rooted the box and
> replaced the default login shell with a rootkitted/backdoored one in a newer
> executable format not supported by the old kernel.

I think it's also what you get if you compile glibc with, say,
--enable-kernel=2.4.20 and boot 2.4.19 and earlier. But in your
case, probably the above.

-- 
http://www.pervalidus.net/contact.html

Re: FATAL: Kernel too old

[Richard B. Johnson]

On Fri, 6 Feb 2004, Charles Cazabon wrote:

> Richard B. Johnson <root@chaos.analogic.com> wrote:
> >
> > Script started on Fri Feb  6 15:44:32 2004
> > # rlogin -l johnson quark
> > ATAL: kernel too old
> > # rlogin -l johnson quark
> > ATAL: kernel too old
>
> I saw something similar at a customer's site, when someone rooted the box and
> replaced the default login shell with a rootkitted/backdoored one in a newer
> executable format not supported by the old kernel.
>
> > I crashed it and it rebooted fine, little fsck activity, with
> > nothing in any logs that shows there was any problem whatsoever.
>
> Did the problem go away with a reboot?

Sure. And if you can 'root' that machine, you are really
good! It isn't even visible to most of the company internally!


Cheers,
Dick Johnson
Penguin : Linux version 2.4.24 on an i686 machine (797.90 BogoMips).
            Note 96.31% of all statistics are fiction.

Re: FATAL: Kernel too old

[Bryan Andersen]

Richard B. Johnson wrote:
> On Fri, 6 Feb 2004, Charles Cazabon wrote:
> 
> 
>>Richard B. Johnson <root@chaos.analogic.com> wrote:
>>
>>>Script started on Fri Feb  6 15:44:32 2004
>>># rlogin -l johnson quark
>>>ATAL: kernel too old
>>># rlogin -l johnson quark
>>>ATAL: kernel too old
>>
>>I saw something similar at a customer's site, when someone rooted the box and
>>replaced the default login shell with a rootkitted/backdoored one in a newer
>>executable format not supported by the old kernel.
>>
>>
>>>I crashed it and it rebooted fine, little fsck activity, with
>>>nothing in any logs that shows there was any problem whatsoever.
>>
>>Did the problem go away with a reboot?
> 
> Sure. And if you can 'root' that machine, you are really
> good! It isn't even visible to most of the company internally!

You never know what your fellow employees will do...  Where there is a 
will there is a way.

If you don't think it got rooted, what did you or other employees do 
recently on that machine that would cause software to be changed?  Did 
anybody do any upgrades?  Unless you can confirm an alternate 
explanation then I'd assume it was rooted.  If the machine was upgraded 
by downloading from the net, was the site you downloaded from secure? 
Just because a machine is behind many fire walls doesn't mean that it 
can't be rooted.

- Bryan

Re: FATAL: Kernel too old

[Karl Tatgenhorst]

>
>
>
>Sure. And if you can 'root' that machine, you are really
>good! It isn't even visible to most of the company internally!
>
>
>Cheers,
>Dick Johnson
>
Not a big contributor here, but the first thing I thought when I saw the 
message was root kit. Granted you may have to be 'good' to root the box, 
or to know that it is present in the corp network. However, you did say 
it is forwarding mail which means it receives mail, thus it has an 
identifiable and locatable IP address. Also, it was stated that it was a 
generic RH running 2.4.18 (I think) and no hacking done to it. Is it 
kept up  to date, current libraries etc... From what you said it sounds 
like a rarely thought of recipient of internet services (e-mail) or what 
some like to call "a target of opportunity"

Karl Tatgenhorst

Re: FATAL: Kernel too old

[Andrew Walrond]

I have seen this message when trying to use a glibc configured with
        --enable-kernel=2.4.20
on a machine running a 2.4.19 kernel.

You haven't either upgraded glibc or started using an older kernel, have you?

Andrew

Re: FATAL: Kernel too old

[Frédéric L. W. Meunier]

On Sat, 7 Feb 2004, Andrew Walrond wrote:

> I have seen this message when trying to use a glibc configured with
>         --enable-kernel=2.4.20
> on a machine running a 2.4.19 kernel.
>
> You haven't either upgraded glibc or started using an older kernel, have you?

I think it also happens if you run a binary compiled on a
machine with such a glibc on another which has an older kernel
or the same glibc, but compiled with no --enable-kernel or an
older version set.

Can't test it, but:

My glibc was compiled with --enable-kernel=2.4.5.

A binary compiled with it:

% file /usr/bin/lsattr
/usr/bin/lsattr: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.4.5, dynamically linked (uses shared libs), stripped

A binary that came with the default glibc:

% file /usr/bin/ansi2knr
/usr/bin/ansi2knr: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.0.0, dynamically linked (uses shared libs), stripped

Yes, the default glibc was compiled without --enable-kernel, so
is compatible with >= 2.0.0.

Anyway, not a kernel problem. I have also seen it when trying
to emulate my binaries on FreeBSD, which has compatibility set
to... 2.4.2.

-- 
http://www.pervalidus.net/contact.html