Re: Cannot login to server running RH6.2
> Guys,
>
> I know that this list does not deal with Red Hat Linux issues, but then
this
> is the most helpful list that I can think of that has good support. The
> discussion list on redhat.com sux. Typically I use Debian on my system.
> Since this is my company's server...
>
> Ok, here's the problem : I cannot seem to login to my server. When I do a
> telnet session, an error message appears :
> telnetd: /bin/login: No such file or directory; and immediately it
> terminates the session. I FTPed into the server and checked the /bin dir.
> and most certainly that file is missing. I tried to even login on the
> console itself, and it goes fine for the login but when I press enter, it
> returns to the login prompt. I cannot login at all to my system.
>
> How do I install back that login file in to the /bin directory. Where can
I
> get that file from. The only way that I can login to the system is :
linux
> single, and that method doesn't start the net connection, and I do not
have
> my RH Linux 6.2 CDs with me.
>
> What happened to my system. This just popped up out of nowhere. Quite a
> few others have the similar problems on RH discussion list, but so far
there
> is no answer to the questions.
>
> Is this a bug on RH Linux ? or is this a virus, or hacker or what ?
>
> Does this thing happen to Debian ? As far as I have used my Debian
system,
> it hasn't given me any problems. Only thing slacking is a good
> administration tool for it like smitty. :-)
>
> Thanks in advance.
>
> Cheers,
> Saran.
>
>
> --
> To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
>
>
One way of fixing the problem would be to ftp into your box while in
multiuser mode, and copy the binary on to the machine that way (just get a
copy of /bin/login from another linux machine - preferably another RH6.2
machine). Then, boot up in single user mode and move it into the /bin
directory.
As to how it happened... I don't have much to suggest except that it's
possible that your machine was cracked into - be very suspicious of the
machine until you confirm that this hasn't happened. Look through the logs
for anything suspicious, compare the version of system binaries such as 'ps'
and 'ls' against known-good copies from an equivalent system, and watch for
unusual network traffic. This may be a good excuse to rebuild the machine
as a Debian box... :)
- Kevin.
Reply to: