Have I been hacked? Shadow file deleted
Scot L. Harris
webid at cfl.rr.com
Fri Sep 9 14:21:56 UTC 2005
On Fri, 2005-09-09 at 10:06, Jose Luis Hime wrote:
> chkrootkit and rkhunter do not report any problem.
>
> I am still with this issue, any hints?
>
How many people have access to root? Assume you have changed the root
password as well as checked the /etc/passwd and /etc/shadow files for
any odd entries.
What permissions does the /etc/shadow file have?
You should also check all cron jobs to see if someone set something up
there.
Last resort is to do a complete bare metal install again and keep root
password to yourself.
More information about the fedora-list
mailing list