[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

RE: Have I been hacked? Shadow file deleted



On Fri, 2005-09-09 at 10:06, Jose Luis Hime wrote:
> chkrootkit and rkhunter do not report any problem.
> 
> I am still with this issue, any hints?
> 

How many people have access to root?  Assume you have changed the root
password as well as checked the /etc/passwd and /etc/shadow files for
any odd entries.

What permissions does the /etc/shadow file have?

You should also check all cron jobs to see if someone set something up
there.

Last resort is to do a complete bare metal install again and keep root
password to yourself.




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]