[Novalug] cant remove ssh. cant even chown it
Norman Bird
steelpulsefan@gmail.com
Tue Jul 22 21:16:57 EDT 2008
Look what happened when i did this:
server1:/usr/sbin# who is 501
root pts/0 2008-07-22 18:03 (:0.0)
what does this mean? maybe 501 is root in debian etch.?
On Tue, Jul 22, 2008 at 9:10 PM, Norman Bird <steelpulsefan@gmail.com>
wrote:
> no user 501. checked those files just now. good idea though thanks
>
> On Tue, Jul 22, 2008 at 7:29 PM, Mike Shade <mshade@mshade.org> wrote:
>
>> > -rwxr-xr-x 1 501 root 236457 2008-05-15 07:36 sshd
>>
>>
>> Why on *earth* is sshd owned by a user? Did you at one point do a chown
>> -R from / by mistake?
>>
>> Even more interesting is that it's giving you the UID instead of a user's
>> name. Do you *have* a user 501? Check with:
>>
>> # grep 501 /etc/passwd /etc/shadow /etc/group (as root)
>>
>> You may also want to run chkrootkit, as this is not normal ;)
>>
>> -- Mike
>>
>>
>> _______________________________________________
>> Novalug mailing list
>> Novalug@calypso.tux.org
>> http://calypso.tux.org/cgi-bin/mailman/listinfo/novalug
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.firemountain.net/pipermail/novalug/attachments/20080722/01c7386f/attachment.htm>
More information about the Novalug
mailing list