topic Passwd change automatically in Operating System - HP-UX

Passwd change automatically

Abdullah Abu Diyab — Wed, 08 Oct 2003 07:33:56 GMT

Dear All,

I face a strange problem, where actually the passwd for the root user change automatically.
I do not know what I have to do? and how it is happend
Note : there is no sudo users and no one know the password for the root except me !!!!

Please your help ASAP.

Kind Regards

Re: Passwd change automatically

Graham Cameron_1 — Wed, 08 Oct 2003 07:41:11 GMT

This cannot happen on its own, some process must have updated the /etc/passwd file.
--
What's the timestamp on /etc/passwd ?
Do you have an earlier copy you can compare it with?
Can you look in /var/adm/cron/log to see what cron jobs have run, and check them all out?
Are there any other id 0 users in the /etcpasswd file (grep :0: /etc/passwd). If so that could be the culprit.
--
If it has changed to domething you don't know and you can't get in, you'll have to crash the system and reboot single user.
Graham

Re: Passwd change automatically

A. Clay Stephenson — Wed, 08 Oct 2003 07:42:20 GMT

First, when the password changes, how do you get back in? Have you left a 'backdoor' or must you boot single-user?

Is the console physically secure? If not then it would be easy for someone to change the root passwd. Do the last boot times agree with your memory/logs?

The most obvious place to look is for setuid programs which are owned by root. I suspect a Trojan Horse. Also look for rogue cron/at jobs.

Re: Passwd change automatically

Umapathy S — Wed, 08 Oct 2003 07:45:39 GMT

How do you verify the passwd is changed suddenly. If its changed how did you login? Did you check from some other terminals/keyboards.

Your system might have been compromised. Do you have the passwd file backedup anywhere?