password failure RH9

jdraper · 06-29-2005, 01:11 PM

My RH9 Linux box serves up web pages with Apache. As such it gets attacked all day long (mostly from Russia, Korea, China, etc.). I always wonder if someone will penetrate my password system but I have super cryptic passwords.

Yesterday non of my passwords worked including root. This has happened before. A boot fixes the problem but I am sure that something is askew. I checked many logs and nothing shows there is no evidence of an intruder.

Anyone seen this?

Jerry

gnukish · 06-29-2005, 01:47 PM

You can try using a boot loader password to prevent such happenings.
You can also, try changing the passwords frequently to anything that might not be used in any of ur other a/c like bank/ebay/paypal etc. These are just general measures, not particularly aimed at linux ...

Regards

69_rs_ss · 06-29-2005, 01:49 PM

I'd suggest booting from trusted media such as a live cd and run rkhunter or another equivalent and see if there are any root kits present.

gnukish · 06-29-2005, 01:53 PM

rootkits , in linux don't seem to be the biggest threat. It can perhaps be a hardware keylogger or a kernel level keylogger. You must also check for rootkits, as they should not be given best and the least importance, its one of the tools, which hackers use often on nt,xp or any os.

Your kernel version and build, also matters because kernel 2.4.x can be backdoored. Refer google, or packetstorm security archive.

Regards