Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
|
11-13-2006, 09:31 AM
|
#1
|
Member
Registered: Sep 2005
Location: Vienna, Austria
Distribution: Mint 13
Posts: 524
Rep:
|
Been Hacked! May I get control of my Root user again?
Hi!
It looks like I have been hacked last week. I can't log with neither root or other users with sudo rights. I have physicall access to the server and would like to know if there is a possibility to get control over my server (FC 6) again with the help of any tool like a rescue live cd that would allow me to set up a new root's password?
thanks for any help.
P.S. I would like to get in the machine again in order to get a few datas and have a look at the log files. Then I plan to reinstall the whole stuff again.
|
|
|
11-13-2006, 09:35 AM
|
#2
|
Moderator
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417
|
as long as you don't ever plan to *use* the server to any extent again then that's fine... at the bootloader screen go into edit mode, e in grub, not sure what it is in lilo, and just add a "1" into the kernel options and then boot. this will automatically dump you in as root letting you change whatever you want to...
|
|
|
11-13-2006, 03:30 PM
|
#3
|
Member
Registered: Apr 2006
Location: Finland
Distribution: Ubuntu, Gentoo, Debian
Posts: 88
Rep:
|
remember if there is a rootkit present, the hackers files can be hidden from the system. If you want to find them, use a livecd.
|
|
|
11-13-2006, 06:45 PM
|
#4
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
To follow up, once you are able to get access to the system, take a look at the links in the security references thread at the top of the forum. Take a look at the section "Compromise, breach of security, detection", In particular the links to CERT's Intruder Detection Checklist and "Steps for Recovering from a UNIX or NT System Compromise" will likely be useful in diagnosing the source of the compromise. Remember that if you are truly compromised, then a full reinstall from trusted media is the *only* way you can be sure that the system is secure.
|
|
|
11-14-2006, 08:46 PM
|
#5
|
LQ Newbie
Registered: Dec 2003
Location: Blacklick, OH
Distribution: CentOS 4.x; also OS X.4
Posts: 17
Rep:
|
Install chkrootkit
You can find chkrootkit at www.chkrootkit.org. It should show you what needs to be deleted, corrected, etc.
I am running CentOS 4.x and install it on all of my machines. I currently have 3 running CentOS.
Cheers!
|
|
|
All times are GMT -5. The time now is 11:24 AM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|