Re: Weird and insecure su problem: FIXED
On Fri, 15 Nov 2002 01:05:11 +0000, Glyn Kennington
<glyn.kennington@hertford.oxford.ac.uk> wrote:
>Pigeon wrote:
>> If, however, I enter _no_ password, I get:
>> : command not found
>> ' is not an octal number from 000 to 777
>> : command not found
>> : command not found
>>
>> and a somewhat mangled prompt; then
>> whoami
>> root
>>
>> - so I've su'ed to root without entering a password. WHAT?
>>
>> Wondering about the mangled prompt, I did echo $PS1 | hexdump and got:
>>
>> 68 5c 5c 3a 5c 77 20 24 0a 0d
>> ^^^^^
>
>Eek! Sounds messy. A few things to try:
>
>fsck. There could well be a mangled file there, especially when you shut
>the system down without the normal shared libraries.
Done that - several times :-)
>And the `not an octal number' error suggest broken permissions somewhere.
It does, doesn't it? That was Microsoft's fault for their LF/CR line
break standard. In order to get my Linux box to boot again I had to
manually copy in the files from
dists/slink/main/disks-i386/2.1.11.1-1999.09.08/base2_1.tgz. Because I
couldn't run tar & gzip, I had to unpack it with WinZip on my Windoze
box. This resulted in every text file having LF/CR line breaks in,
including /root/.profile, the source of this particular error.
>Check that /etc/passwd and /etc/shadow match the descriptions in `man
>passwd` and `man shadow` respectively.
Hey, thanks for that. It was /etc/shadow: the root password in it was
corrupted, though the pigeon password was OK. To fix it, I simply
copied /etc/passwd to /etc/shadow. It works now. Cool! Thanks.
>But *DON'T* send them here for a second opinion.
Interesting. Is this simply to avoid filling the list with junk? Given
that people post X / system logs etc. for a second opinion, probably
not. Are you assuming that my passwords may not be safe against a
brute-force dictionary attack, or has the "one-way" nature of the
encryption algorithm been compromised?
Thanks again,
Pigeon
Reply to: