Re: su fails

2003-07-17 Thread Andrew Langdon-Davies
On Wed, 16 Jul 2003 18:11:10 -0700, Stephen Samuel <[EMAIL PROTECTED]> wrote: I haven't had the timer for a full report, but, althought I'm not CLEAR that his box has been rooted, things like minor changes to su, and other wierd things failing are signs of a rootkit (yes, a clumsy one) being inst

Re: su fails

2003-07-16 Thread Stephen Samuel
I haven't had the timer for a full report, but, althought I'm not CLEAR that his box has been rooted, things like minor changes to su, and other wierd things failing are signs of a rootkit (yes, a clumsy one) being installed. Having su suddenly start to give different messages is a sign that SOME

Re: su fails

2003-07-16 Thread Andrew Langdon-Davies
Unaddresed possibilities do include: 1. That you somehow were tricked into downloading and installing a trojan app on the Slackware host. This is unlikely if you've stuck to "official" Slackware update sites, and not even all that likely if you've downloaded the sourcve of well-known apps from

Re: su fails

2003-07-15 Thread Ray Olszewski
At 08:20 PM 7/15/2003 +0200, Andrew Langdon-Davies wrote: Now here I'd probably agree IF there is even the slightest doubt that the system may have been compromised , Clear it & start fresh . Be extremely careful of re-applying the user(s) data . Hth , Ji

Re: su fails

2003-07-15 Thread Andrew Langdon-Davies
Now here I'd probably agree IF there is even the slightest doubt that the system may have been compromised , Clear it & start fresh . Be extremely careful of re-applying the user(s) data . Hth , JimL ...snip... I know this is a very wide-open question, bu

Re: su fails

2003-07-15 Thread beolach
--- Ray Olszewski <[EMAIL PROTECTED]> wrote: >> >>I thought reinstalling shadow had put everything right, but there are >>still hiccups. For example, although I can now su again --that is, it >>now >>recognises the password-- if I give the wrong password I still get >>just 'sorry'. > >I presume yo

Re: su fails

2003-07-15 Thread Mr. James W. Laferriere
Hello Alan , On Tue, 15 Jul 2003, Alan Bort wrote: > Well... I think bash actually has a builtin su... so if you reinstall Fyi , bash (as of 2.05b.0(1)-release) does not have a builtin of "su" . try typing 'help' at the bash shell prompt for one . Then just do eit

Re: su fails

2003-07-15 Thread Ray Olszewski
At 01:06 PM 7/15/2003 -0400, Alan Bort wrote: Well... I think bash actually has a builtin su... so if you reinstall bash (not a very big package anyway)... it might help. since you've already installed shadow again... On what basis do you think this to be true? I've never heard of such a capabili

Re: su fails

2003-07-15 Thread Alan Bort
Well... I think bash actually has a builtin su... so if you reinstall bash (not a very big package anyway)... it might help. since you've already installed shadow again... Anyway... I agee with the (quote)'I'd just load a new OS and migrate the user data over to it.'(/quote) idea... El mar, 15-07

Re: su fails

2003-07-15 Thread Andrew Langdon-Davies
It sounds to me like you've been rooted, and somebody installed a trojan. I'd do a full hunt for signs of a rootkit. When in doubt (especially if there are ony a few people on your system), I'd just load a new OS and migrate the user data over to it. I don't want to sound like Pollyanna, but inter

Re: su fails

2003-07-15 Thread Ray Olszewski
At 12:20 PM 7/15/2003 +0200, Andrew Langdon-Davies wrote: On Mon, 14 Jul 2003 15:39:01 -0700, Stephen Samuel <[EMAIL PROTECTED]> wrote: It sounds to me like you've been rooted, and somebody installed a trojan. I'd do a full hunt for signs of a rootkit. When in doubt (especially if there are ony a

Re: su fails

2003-07-15 Thread Andrew Langdon-Davies
On Mon, 14 Jul 2003 15:39:01 -0700, Stephen Samuel <[EMAIL PROTECTED]> wrote: It sounds to me like you've been rooted, and somebody installed a trojan. I'd do a full hunt for signs of a rootkit. When in doubt (especially if there are ony a few people on your system), I'd just load a new OS and m

Re: su fails

2003-07-14 Thread Andrew Langdon-Davies
> > It says only "Sorry" > NO it does not, it says, "Authentication failure" and then sorry. I can assure you, sir, in spite of your block capitals, that it said just "Sorry". Which also surprised me, I may say, and attracted Mr Oswelski's attention too. I thought at the time it was a touch cur

Re: su fails

2003-07-14 Thread pa3gcu
On Monday 14 July 2003 19:52, Andrew Langdon-Davies wrote: > >> su: Authentication failure > >> Sorry. > >> [EMAIL PROTECTED]:~$ > > > > It says only "Sorry" > > NO it does not, it says, "Authentication failure" and then sorry. I have encoured a simalar problem years ago, my problem was caused by

Re: su fails

2003-07-14 Thread Andrew Langdon-Davies
--- Forwarded message --- Oops, Sorry On Mon, 14 Jul 2003 08:15:00 -0700, Ray Olszewski <[EMAIL PROTECTED]> wrote: At 01:04 PM 7/14/2003 +0200, Andrew Langdon-Davies wrote: As of a few days ago, when I do 'su' and enter the password at the prompt I get turned down with the reply 'Sorr

Re: su fails

2003-07-14 Thread Ray Olszewski
At 01:04 PM 7/14/2003 +0200, Andrew Langdon-Davies wrote: As of a few days ago, when I do 'su' and enter the password at the prompt I get turned down with the reply 'Sorry'. Does it say *only* "Sorry" or actually something like this (note the extra line): [EMAIL PROTECTED]:~$ su

su fails

2003-07-14 Thread Andrew Langdon-Davies
As of a few days ago, when I do 'su' and enter the password at the prompt I get turned down with the reply 'Sorry'. I can login normally as either root or normal user. I have tried changing passwords but it makes no difference. It happens in text mode and with X running. This is Slackware 9.0 wi