Passwd change automatically

[Abdullah Abu Diyab]

Dear All,

I face a strange problem, where actually the passwd for the root user change automatically.
I do not know what I have to do? and how it is happend
Note : there is no sudo users and no one know the password for the root except me !!!!


Please your help ASAP.

Kind Regards

[Graham Cameron_1]

This cannot happen on its own, some process must have updated the /etc/passwd file.
--
What's the timestamp on /etc/passwd ?
Do you have an earlier copy you can compare it with?
Can you look in /var/adm/cron/log to see what cron jobs have run, and check them all out?
Are there any other id 0 users in the /etcpasswd file (grep :0: /etc/passwd). If so that could be the culprit.
--
If it has changed to domething you don't know and you can't get in, you'll have to crash the system and reboot single user.
Graham

[A. Clay Stephenson]

First, when the password changes, how do you get back in? Have you left a 'backdoor' or must you boot single-user?

Is the console physically secure? If not then it would be easy for someone to change the root passwd. Do the last boot times agree with your memory/logs?


The most obvious place to look is for setuid programs which are owned by root. I suspect a Trojan Horse. Also look for rogue cron/at jobs.

[Umapathy S]

How do you verify the passwd is changed suddenly. If its changed how did you login? Did you check from some other terminals/keyboards.

Your system might have been compromised. Do you have the passwd file backedup anywhere?