Hello,

i think my linux box is hacked. i am having a RedhatLinux 7.3 installed. The problem is that someone has made some changes in startup/shutdown scripts so that whenever i shutdown linux, the system goes in to maintenance mode i.e runlevel 1. so accessing runlevel anybody could easily do anything with the system.

I tried to read the log files but didn't found anything. for instance to save my system i have also modified the script /etc/rc.d/rc so that whenever system goes into maintenance mode it asks for the root passwd.

I want to know how could someone having guest access do such a task of modifying the scripts. How can solve this problem and deny such activities in future.

Thanks in advance for help...

LQ Wiki

http://wiki.linuxquestions.org/wiki/Security

you've got some reading to do....so have fun

First, try verifying the integrity of the init scripts using rpm -V <package> or just rpm -Va to verify them all. With the system going to run-level 1, only someone with local access would be able to use the machine, so you might want to think about who else has physical access to the machine. You should also take a look at the access logs (last and last -i) for abnormal access times, look at /etc/passwd for any abnormal users or users other than root with a UID of 0. You should also download and run chkrootkit or rootkit hunter to identify whether a rootkit has been installed (they have a tendency to bork the startup/shutdown files if they don't install properly).

In terms of how could this happen, Redhat 7.3 has not been supported for some time and unless youve been manually patching to keep up with recent security vulnerabilities, then there would be a number of local root exploits in the system that would allow a "privilege escalation" attack.

Hi.
i think you are using shutdown command. to remind you shutdown command with no options and arguemtns will place you in single user mode. if you want to poweroff the system use 'shutdonw -h now' or if you want to use restart 'shutdown -r now'. for more information read 'man shutdown'

HTH,