| View previous topic :: View next topic |
| Author |
Message |
dknzubzero
n00b
Joined: 18 Sep 2004
Posts: 8
|
 Posted: Thu Oct 21, 2004 8:35 pm Post subject: root pass changed, did i get hacked? |
 |
|
hey.
about 20 min ago i emerged a couple of things using the root user, it worked perfecly.
now just a few mins ago i wanted to log in again (by ssh as i always do)
but my password was wrong, i checked speeling, caps etc etc. didn't help.
tryed locally on the server (its right next to me) and i couldn't log in there either...
ctrl+alt+f1 .. i had left a root consol open.. passwd and now the root user works again.. but..
as i thought a friend (who have my root pass since he's the one i turn too when having linux problems) was playing i joke on me i though that i would make a backup root (admin) so that i could use that for his next joke... i use "Kuse" to add it.. marks all the groups and hit the ok button... and then an error comes up
| Code: |
file /etc/gshadow does not exist
Can't create backup file for /etc/gshadow
|
Kuser have markings in all the groups i choosed yet it doesn't seem to work... the user is an copy of the root user (i added "games")
trying to do a passwd another user... an emerge cmd... or to play "ski"
passwd [user[ = you may not chance the pass of....
emerge= you need to be in portage group... you need root priv.
ski = cmd not found...
i should have access to all of them...
the server is open to the net, no firewall and the NAT doesn't touch it.. the router is so bad to port management that i just open up for the server to avoid any more problems...
did i get hacked or did someone just make a good joke in me? |
|
| Back to top |
|
 |
hds
Advocate
Joined: 21 Aug 2004
Posts: 2629
Location: Sprockhoevel [GER]
|
| Posted: Thu Oct 21, 2004 9:02 pm Post subject: |
|
|
it is not enough to be in all groups. you have to be the one and only user called "root" for some things.
have a look at the filepermissions of /etc/gshadow - to talke your example. they are 400 root:root, so only the user root can modify this file.
same goes for emerge. actually it is just a sript - view it! it checks if the user root is running it.
Last edited by hds on Thu Oct 21, 2004 9:05 pm; edited 1 time in total |
|
| Back to top |
|
|
dknzubzero
n00b
Joined: 18 Sep 2004
Posts: 8
|
| Posted: Thu Oct 21, 2004 9:05 pm Post subject: |
|
|
| i'm logged in as root when using Kusers .. so i should have access to it... ? |
|
| Back to top |
|
|
hds
Advocate
Joined: 21 Aug 2004
Posts: 2629
Location: Sprockhoevel [GER]
|
| Posted: Thu Oct 21, 2004 9:08 pm Post subject: |
|
|
| dknzubzero wrote: | | i'm logged in as root when using Kusers .. so i should have access to it... ? |
ah, sorry! i understood you that you were working as the user "admin" - my fault then.
anyway, i dont know kuser - but fact remains that only the user root is able to run emerge and able to modify gshadow.
also i just realize your gshadow doesnt even exist! well, thats strange 
btw: you could run "grpconv", to create gshadow, but i would wonder why this file is missing in the 1st place |
|
| Back to top |
|
|
dknzubzero
n00b
Joined: 18 Sep 2004
Posts: 8
|
| Posted: Fri Oct 22, 2004 10:49 am Post subject: |
|
|
thats why i was thinking hacker instead of joke... since my friends wouldn't destroy something in my system.. also they (the two who knows the password) where not even home last night..
I've used Kuser before.. (its the KDE user admin program)..
the system is stable and from what i've checked so far i've lost no data... so i'm just gonna find a new password and see whats happends... also i've scanned with a few rootkit-scanners. all came out cleane...
but thx for the help.. i learned something new  (being in root-group doesn't make you all that cool  ) |
|
| Back to top |
|
|
Paulten
Apprentice
Joined: 28 Mar 2003
Posts: 257
Location: Sykkylven, Norway
|
| Posted: Fri Oct 22, 2004 1:09 pm Post subject: |
|
|
why don't you just check the logs?
"last" is usefull for this
_________________
Homepage : http://paul.kde.no Jabber ID : tenfjord@jabber.org
"Dei levde som dyr. Dei verken røykte eller drakk" -Ukjent |
|
| Back to top |
|
|
|
Networking & Security
