Re: no more /sbin in root path... been rooted?
On Thursday 05 September 2002 10:10, Indra Kusuma wrote:
>
> hmm .. strange, when you "su -" then its use login
> if your box has been rooted, posible backdoor is in the /bin/login
> maybe you should re-install the login package, just to make sure.
>
> but before that please recheck /etc/login.defs, /etc/profile, /etc/bashrc,
> ~/.bashrc
>
done that again, but this files are ok (I have exactly the same on my other
woody box, and it behaves correctly). Then done "apt-get --reinstall install
login", nothing changed.
So, I commented out the PATH statement in /etc/profile (since this is already
defined in /etc/login.defs, as I said in my initial post), and *magically*
the root path is then OK. But then why does it work WITH the path statement
on my other woody box? Isn't it weird that the login process differs between
these 2 machines? Moreover, I'm pretty sure I haven't changed this
/etc/profile since months (maybe years, since that debian box originally have
been installed with the hamm distribution, upgraded to slink, potato, then
woody. Never done a complete reinstall, maybe I should).
My conclusion for now is that maybe a recent upgrade changed the login
process, and that I have an old config file (other than /etc/profile and
/etc/login.defs) that triggered that bug.
Is the whole login process on Debian described somewhere, with the order in
which the files are read? I'd really like to sort out this problem, so I'll
be pretty sure my machine haven't been cracked.
Thanks again for your help,
David.
Reply to: