su fails in console

rundjuling · 10-19-2004, 07:38 PM

Hi!

A couple of days ago I updated my system using up2date and since then I haven't been able to use su from console.

Each time I type su, I get an error message at once saying "su: wrong password" even though I didn't even type a password. I've read many suggestions from others with similar problems, but no one has helped me yet.

I have altered the /etc/group file, so that my user is in the wheel group:
wheel:x:10:root,my_user

I also read that I should uncomment one line in /etc/pam.d/su, so I did:
# Uncomment the following line to require a user to be in the "wheel" group.
auth required /lib/security/$ISA/pam_wheel.so use_uid

I have also both chowned, chmoded and even chgrped /bin/su like some suggestions claimed would help:
chown root:root /bin/su
chgrp wheel /bin/su
chmod 4750 /bin/su

I also SUIDed /bin/su:
chmod +s /bin/su

And still I get the "su: wrong password" when entering su in console.
Is there anything I haven't tried yet that will help? I'd like to know about it!

Thanks

Doomhammer · 10-19-2004, 09:27 PM

su - root

rundjuling · 10-20-2004, 06:41 AM

Quote:

Originally posted by Doomhammer
su - root

Thanks, but I get the same result as before...

rundjuling · 10-20-2004, 04:35 PM

Does anyone have a suggestion to this problem?

Tinkster · 10-20-2004, 04:54 PM

do an
ldd `which su` and check the perms on the libs
it uses ...

ldd `which su` | awk '{print $3}' | xargs ls -l

Cheers,
Tink

P.S.: Do NOT bounce your posts until 24 hours without
a response have passed ...

rundjuling · 10-21-2004, 10:44 AM

Quote:

Originally posted by Tinkster
do an
ldd `which su` and check the perms on the libs
it uses ...

ldd `which su` | awk '{print $3}' | xargs ls -l

Thanks, I tried that and I got a response like this one:
lrwxrwxrwx 1 root root 13 okt 18 03:27 /lib/i686/libc.so.6 -> libc-2.3.2.so

Should I change the perms so others than root can use it? Maybe the wheel group?

Quote:

Originally posted by Tinkster
P.S.: Do NOT bounce your posts until 24 hours without
a response have passed ...

Sorry, won't happen again...

Tinkster · 10-21-2004, 11:43 AM

That's just a link, and the perms on it are fine.
Look at the file the link points to.

ldd `which su` | awk '{print $3}' | xargs ls -lL
to dereference it ...

Cheers,
Tink

rundjuling · 10-21-2004, 04:21 PM

Quote:

Originally posted by Tinkster
That's just a link, and the perms on it are fine.
Look at the file the link points to.

ldd `which su` | awk '{print $3}' | xargs ls -lL
to dereference it ...

Yeah, that gives me:
-rwxr-xr-x 1 root root 1288460 nov 5 2003 /lib/i686/libc.so.6

Some different permissions there, but are they like they should be, you think?

Tinkster · 10-21-2004, 05:56 PM

Yep, perms look perfectly sane to me....

But one thing is quite odd, sorry that I didn't notice
that earlier ... my output looks different from yours on
all machines:

Here's my Slack-notebook:

Code:

[tink@diggn:~]$ ldd `which su` | awk '{print $3}' | xargs ls -lL
-rwxr-xr-x  1 root root   83268 May 25 16:44 /lib/ld-linux.so.2
-rwxr-xr-x  1 root root 1250840 May 25 16:44 /lib/libc.so.6
-rwxr-xr-x  1 root root   18992 May 25 16:44 /lib/libcrypt.so.1

Here's one of our debian-servers:

Code:

# ldd `which su` | awk '{print $3}' | xargs ls -lL
-rwxr-xr-x    1 root     root        90144 Nov  6  2003 /lib/ld-linux.so.2
-rw-r--r--    1 root     root      1243076 Nov  6  2003 /lib/libc.so.6
-rw-r--r--    1 root     root        18636 Nov  6  2003 /lib/libcrypt.so.1
-rw-r--r--    1 root     root         9796 Nov  6  2003 /lib/libdl.so.2
-rw-r--r--    1 root     root        29420 Jan 22  2002 /lib/libpam.so.0
-rw-r--r--    1 root     root         7500 Jan 22  2002 /lib/libpam_misc.so.0

And a RedHat AS:

Code:

$ ldd `which su` | awk '{print $3}' | xargs ls -lL
-rwxr-xr-x    1 root     root       106912 Aug 31 10:42 /lib/ld-linux.so.2
-rwxr-xr-x    1 root     root        23388 Aug 31 10:42 /lib/libcrypt.so.1
-rwxr-xr-x    1 root     root        14868 Aug 31 10:42 /lib/libdl.so.2
-r-xr-xr-x    1 root     root         8548 Aug 25 02:19 /lib/liblaus.so.1
-rwxr-xr-x    1 root     root         8472 Aug 19 09:43 /lib/libpam_misc.so.0
-rwxr-xr-x    1 root     root        30488 Aug 19 09:43 /lib/libpam.so.0
-rwxr-xr-x    1 root     root      1568924 Aug 31 10:42 /lib/tls/libc.so.6

I don't know what the liblaus on the RH box does, and find
it normal for the Slackware one not to have libpam* since
Pat doesn't use it (yet) ... but that yours shouldn't't have
ANYTHING but libc is bewildering ...

Did you check your machine for rootkits lately?

Cheers,
Tink