Re: no more /sbin in root path... been rooted?
On Thursday 05 September 2002 04:42, Indra Kusuma wrote:
> On Wed, 4 Sep 2002, David Raulo wrote:
>
> > Hi all,
> > I have 2 woody boxes, the first one configured as an adsl firewall (a
> > simple iptable-deny-everything stuff, no local service running, only LAN
> > originated traffic allowed). On the second box since yesterday, my path
> > when logging as root became
> > "/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games", like the one for
> > an ordinary user. Same behavior if I "su -" from an ordinary account,
> > but the good old root path is back if I just type "su" (without the
> > hyphen).
> >
> > Where does Debian define the root login path? I checked /etc/login.defs
> > (and of course /root/.bashrc), but nothing changed / my other woody box.
> > Btw why is the default user path defined both in /etc/login.defs and
> > /etc/profile?
> >
> > Is this strange behavior a known sign of intrusion? I got nothing unusual
> > in both machines's logs... I also tried chkrootkit, nothing found. Of
> > course I might also have done something wrong, but can't remember what.
> >
> > Does anyone have a hint on what's going on?
>
> Did you login via SSH ??
>
No (I don't have a sshd running). The problem occurs when I log directly on
console, or when I do "su -" from an xterm.
Have you got an idea?
David.
Reply to: