Try to run a chkrootkit, to see if some niaries are replaced. Also, how about the mounts, is /bin probably a mount, or is /bin/login a symlink to a ro filesystem?
Jurgen > Hello Debain Users, > > We have an interesting phenomenon occuring on one of our servers. We have > noticed that two files in the /bin directory have had their executable > permissions removed and we are unable to chmod the files as root. > > current file permissions: > -rw-r--r-- 1 root root 35464 May 31 13:02 /bin/login > -rw-r--r-- 1 root root 54152 Aug 29 2001 /bin/netstat > > when trying to change permissions: > > ns:~# whoami > root > > ns:~# id > uid=0(root) gid=0(root) groups=0(root) > > ns:~# chmod 755 /bin/login > chmod: changing permissions of `/bin/login': Operation not permitted > > We have tried doing the same thing from the rescue disc login prompt. same > outcome. > > This seems to be a serious security issue. Root user seems to have lost > control of some files. Other files can be changed using the above commands. > > Any ideas? > > Best regards, > > Andreas Hatz > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
