I always use the same root password on all my computers & have for many years, I tried to log into one of them that I had logged into many times before. The "could not authenicate"came up. After trying for many times I chrooted into it with no problem and changed the password to what it was supposed to be. What I would like to know is what happened, I have never had this problem and sure would like to know what happened.

This computer is used by a friend of ours and and she can only surf and use gwenview for her photos etc.

Well someone broke your password, maybe SSH brute force. You should check your logs.

1 members found this post helpful.

It may also be possible that if you upgraded your "etc" package that you overwrote some files (e.g. /etc/shadow).

1 members found this post helpful.

It might be the case that the PC has been penetrated. You changed the root password back to what it was supposed to be? Wouldn't the hacker know your password if he changed it(if there is a hacker)? It might be an idea to take the PC off-line and investigate the cause of this incident.

1 members found this post helpful.

It never crossed my mind that it could have been hacked, and I don't know what logs to look at, of course the /var/log will be where I start. I will go ahead and change the password just in case!

Same thing happened to me with an old computer. I always thought I had used the same password but somewhere along space-time, roughly 2 years ago, I added an extra character to my default password. I occasionally forget it.

I've never hacked anyones account before, but I would think if I did I would create a new account for myself with root privs so as not to raise suspicions. What I do on my system is I have a cron job that runs a script similiar to your typical doinst.sh that copies /etc/passwd, etc, compares it to the previous days copy and if there are any changes it emails me.