> rpm --verify --all
>
> That will check all the packages seem sane. It won't neccessarily help
> identify the problem but can reassure you as what if anything may be corrupt.
>
> If it shows up changes in login, netstat, su and the like then assume the
> worst.
> If it shows permission changes on the library then you have a good idea what
> may have happened.
Thanks Alan - spot on. I ran this and there's been a permissions change to
/bin/login a couple of days ago. I smell a hacker... ?
Firstly - GRRRRRRRRRRRR.
Secondly, to get the thing running I'm assuming I can copy a working login
binary from an identical server, so I can get in & change the passwords and
sort the security out?
I'm thinking it's not a coincidence that my system logs disappeared either..
:(
/paul
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://vger.kernel.org/lkml/