[Novalug] cant remove ssh. cant even chown it

Norman Bird steelpulsefan@gmail.com
Tue Jul 22 21:16:57 EDT 2008


Look what happened when i did this:

server1:/usr/sbin# who is 501
root     pts/0        2008-07-22 18:03 (:0.0)


what does this mean? maybe 501 is root in debian etch.?

On Tue, Jul 22, 2008 at 9:10 PM, Norman Bird <steelpulsefan@gmail.com>
wrote:

> no user 501. checked those files just now. good idea though thanks
>
> On Tue, Jul 22, 2008 at 7:29 PM, Mike Shade <mshade@mshade.org> wrote:
>
>> > -rwxr-xr-x 1  501 root  236457 2008-05-15 07:36 sshd
>>
>>
>> Why on *earth* is sshd owned by a user?  Did you at one point do a chown
>> -R from / by mistake?
>>
>> Even more interesting is that it's giving you the UID instead of a user's
>> name.  Do you *have* a user 501?  Check with:
>>
>> # grep 501 /etc/passwd /etc/shadow /etc/group (as root)
>>
>> You may also want to run chkrootkit, as this is not normal ;)
>>
>> -- Mike
>>
>>
>> _______________________________________________
>> Novalug mailing list
>> Novalug@calypso.tux.org
>> http://calypso.tux.org/cgi-bin/mailman/listinfo/novalug
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.firemountain.net/pipermail/novalug/attachments/20080722/01c7386f/attachment.htm>


More information about the Novalug mailing list