RE: Possibly Hacked

["Ben Yau" <byau cardcommerce com>]

> I booted into single user mode and ran a df -h command and the root
> partition is at only 60% so this does not seem to be a disk space
> issue.  I also removed the encrypted password for root and my userid
> from the /etc/shadow file and rebooted.  Now when I enter root or my
> username as the login it does not even ask me for a password and brings
> me back to the login prompt.  Any other ideas as to what might be
> causing this issue?


Although I don't think it's likely, make sure the login shell works.  that
1) the shell in /etc/passwd is the one you expect it to be.  And 2) make
sure the file itself is not corrupted.  e.g. if /bin/bash is your default
shell, verify /bin/bash itself has not been corrupted somehow
(non-executable or file corrupted or whatever).

Just throwing more ideas out there
Ben Y