Re: [oS-EN] Zero bytes /etc/hosts
Lew Wolfgang <[email protected]> Sat, 1 Aug 2026 08:19:44 -0700
| Newsgroups | gmane.linux.suse.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------XSAFpYLPIb6QT5c0LI0NjpZA
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
On 8/1/26 3:48 AM, Carlos E. R. via openSUSE Users wrote:
> Hi,
>
> Bumpy morning.
>
> Power on my laptop, restore from hibernation, it locks with black
> display. Happens too much recently.
>
> Reboot
>
> postfix fails.
>
> localhost fails to resolve.
>
> /etc/hosts is gone, has zero bytes.
>
> I try to mount the backup disk - thunar refuses.
>
> Reboot to previous kernel. Problem persists. Manage to mount backup
> manually, restore /etc/hosts.
>
> Normality.
>
> What could have zeroed /etc/hosts? Dated this morning boot time.
>
> Journal:
>
> Aug 01 12:11:59 Laicolasse.valinor dnsmasq[1673]: read /etc/hosts - 0
> names
>
> System: see signature.
Wow, that's concerning, Carlos.
The filename /etc/hosts was there, but had zero bytes? I seems to imply
intention. A hardware problem causing disk/filesystem corruption would
have left a much bigger mess, I'd think. Could laptop hibernation going
rogue
caused this? Laptop hibernation has a history of being flaky, but
zeroing out
a file seems a bit much.
If intentional, could this imply a security compromise? I remember when I
first started using SuSE around 1998 (vers 5.2 I think) I didn't
initially set up
the firewall because the instructions were in German. I connected it to the
Internet anyway. I then noticed that /etc/tcpd.conf had changed on its own!
The system was remote-root compromised via a mountd bug! I know that
some malware changes /etc/hosts, but zeroing it out?
Regarding the black display, are the graphics Nvidia? I've done dozens of
migrations from Leap 15.6 in the past few months and I've seen the various
Nvidia packages get scrambled with multiple version numbers. On more than
a few occasions I had to remove every shred of Nvidia and start over
again with a clean slate. As a matter of fact, I just checked on the
box I'm
using now and my Nvidia drivers are scrambled! But I'm using the mobo's
Intel Coffee-lake graphics, I should probably remove that board since I'm
not using it. I migrated this box a few weeks ago to Leap 16.
Regards,
Lew
--------------XSAFpYLPIb6QT5c0LI0NjpZA
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 8/1/26 3:48 AM, Carlos E. R. via
openSUSE Users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">Hi,
<br>
<br>
Bumpy morning.
<br>
<br>
Power on my laptop, restore from hibernation, it locks with black
display. Happens too much recently.
<br>
<br>
Reboot
<br>
<br>
postfix fails.
<br>
<br>
localhost fails to resolve.
<br>
<br>
/etc/hosts is gone, has zero bytes.
<br>
<br>
I try to mount the backup disk - thunar refuses.
<br>
<br>
Reboot to previous kernel. Problem persists. Manage to mount
backup manually, restore /etc/hosts.
<br>
<br>
Normality.
<br>
<br>
What could have zeroed /etc/hosts? Dated this morning boot time.
<br>
<br>
Journal:
<br>
<br>
Aug 01 12:11:59 Laicolasse.valinor dnsmasq[1673]: read /etc/hosts
- 0 names
<br>
<br>
System: see signature. </blockquote>
<br>
Wow, that's concerning, Carlos. <br>
<br>
The filename /etc/hosts was there, but had zero bytes? I seems to
imply<br>
intention. A hardware problem causing disk/filesystem corruption
would<br>
have left a much bigger mess, I'd think. Could laptop hibernation
going rogue<br>
caused this? Laptop hibernation has a history of being flaky, but
zeroing out<br>
a file seems a bit much.<br>
<br>
If intentional, could this imply a security compromise? I remember
when I<br>
first started using SuSE around 1998 (vers 5.2 I think) I didn't
initially set up<br>
the firewall because the instructions were in German. I connected
it to the<br>
Internet anyway. I then noticed that /etc/tcpd.conf had changed on
its own!<br>
The system was remote-root compromised via a mountd bug! I know
that<br>
some malware changes /etc/hosts, but zeroing it out?<br>
<br>
Regarding the black display, are the graphics Nvidia? I've done
dozens of<br>
migrations from Leap 15.6 in the past few months and I've seen the
various<br>
Nvidia packages get scrambled with multiple version numbers. On
more than<br>
a few occasions I had to remove every shred of Nvidia and start
over <br>
again with a clean slate. As a matter of fact, I just checked on
the box I'm<br>
using now and my Nvidia drivers are scrambled! But I'm using the
mobo's<br>
Intel Coffee-lake graphics, I should probably remove that board
since I'm<br>
not using it. I migrated this box a few weeks ago to Leap 16.<br>
<br>
Regards,<br>
Lew<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;"><br>
</span></span>
</body>
</html>
--------------XSAFpYLPIb6QT5c0LI0NjpZA--