[Novalug] cant remove ssh. cant even chown it

Norman Bird steelpulsefan@gmail.com
Tue Jul 22 21:10:03 EDT 2008


no user 501. checked those files just now. good idea though thanks

On Tue, Jul 22, 2008 at 7:29 PM, Mike Shade <mshade@mshade.org> wrote:

> > -rwxr-xr-x 1  501 root  236457 2008-05-15 07:36 sshd
>
>
> Why on *earth* is sshd owned by a user?  Did you at one point do a chown -R
> from / by mistake?
>
> Even more interesting is that it's giving you the UID instead of a user's
> name.  Do you *have* a user 501?  Check with:
>
> # grep 501 /etc/passwd /etc/shadow /etc/group (as root)
>
> You may also want to run chkrootkit, as this is not normal ;)
>
> -- Mike
>
>
> _______________________________________________
> Novalug mailing list
> Novalug@calypso.tux.org
> http://calypso.tux.org/cgi-bin/mailman/listinfo/novalug
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.firemountain.net/pipermail/novalug/attachments/20080722/d3f922e8/attachment.htm>


More information about the Novalug mailing list