[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: no more /sbin in root path... been rooted?

On Thursday 05 September 2002 10:10, Indra Kusuma wrote:
> hmm .. strange, when you "su -" then its use login
> if your box has been rooted, posible backdoor is in the /bin/login
> maybe you should re-install the login package, just to make sure.
> but before that please recheck /etc/login.defs, /etc/profile, /etc/bashrc,
> ~/.bashrc

done that again, but this files are ok (I have exactly the same on my other 
woody box, and it behaves correctly). Then done "apt-get --reinstall install 
login", nothing changed.

So, I commented out the PATH statement in /etc/profile (since this is already 
defined in /etc/login.defs, as I said in my initial post), and *magically* 
the root path is then OK. But then why does it work WITH the path statement 
on my other woody box?  Isn't it weird that the login process differs between 
these 2 machines?  Moreover, I'm pretty sure I haven't changed this 
/etc/profile since months (maybe years, since that debian box originally have 
been installed with the hamm distribution, upgraded to slink, potato, then 
woody. Never done a complete reinstall, maybe I should).

My conclusion for now is that maybe a recent upgrade changed the login 
process, and that I have an old config file (other than /etc/profile and 
/etc/login.defs) that triggered that bug.

Is the whole login process on Debian described somewhere, with the order in 
which the files are read?  I'd really like to sort out this problem, so I'll 
be pretty sure my machine haven't been cracked.
Thanks again for your help,


Reply to: