FC9 Compromised...
Aaron Konstam
akonstam at sbcglobal.net
Fri Feb 27 21:25:45 UTC 2009
On Fri, 2009-02-27 at 12:49 -0800, Jack Lauman wrote:
> On Feb 25, between 1753-2046 PST several of my Fedora Core 9 machines
> were compromised. All had the latest patches applied.
>
> 1. Only the installed user accounts are on these machines. The root user
> password is long with upper/lower case characters with numerals &
> punctuation. It is unlikely this was cracked.
>
> 2. All log files were deleted.
>
> 3. The following users were deleted 'root':
> mysql
> apache
> sshd
> dbus
> haldaemon
> dovecot
> gdm
> smmsp
>
> 4. The machine can only be accessed in 'single user' mode. Using
> 'passwd' to reset the root password fails with: "passwd: User not known
> to the underlying authentication module."
I would edit /etc/passwd and /etc/group to restore root entries . Give
root no passwd. Then login as root go to user level 3 and change the
root passwd to whatever you want.
>
> Any help on resolving this would be appreciated. I need to get data off
> these before re-installation.
>
> Have any other incidents like this been reported lately?
>
> Thanks,
>
> Jack
>
--
=======================================================================
Don't I know you?
=======================================================================
Aaron Konstam telephone: (210) 656-0355 e-mail: akonstam at sbcglobal.net
More information about the fedora-list
mailing list