Rooted?

Ok first off im using SUSE 9.1 with the firewall set to high (no services configured) and I am also behind a firewall on the router. Now i havnt had much luck and have been trying to get onto the net for ages with varying sucess, I finally managed this last night and applyed all the security updates to all packages running, now I booted up today and suse watch notifyed me of updates so I clicked to get them but Yast told me my password was incorrect, several tries later I fire up konsole as superuser and as soon as I enter the password it "exits with level 1" this also happens if i su from a normal terminal. I have tried typing my password many times and very slowly (almost as slowly as management :)). I was wondering if it was possible/likely I have been rooted (im new incase you hadnt guessed) or if something horribly wrong has happened, also what can I do about it? If I have been rooted is there any way to recover/change the root password (I have a restricted account that still works fine) and also is there anyway to see if anyone has got in and secure the system to stop future attacks? Any help would be greatly appriciated as I dont want to have to re-install as I have of yet no backup medium :( Thanks

maybe you just are using the wrong password. Not to be an ass but I get calls all the time where people are whining about "there password being changed" when in fact its them who is at fault.

that...and check caps lock.

I wouldn't worry about the "exited with status 1" message. I get that all the time. As far as I know, bash (I assume you are using bash) will exit with the exit status of the last command executed. So it likely has nothing to do with being rooted, but instead, whatever command you are running is probably not working properly. Maybe there's something wrong with the su command (which might also explain why you can't get a password right)?

If you've recently changed the passowrd, maybe you just entered the same typo twice. It's possible.

When you su from a console, does it just give you a bad password error, or does the console just up and quit on you?

Quote:

---

Originally posted here by hellforgedangel
Ok first off im using SUSE 9.1 with the firewall set to high (no services configured)

---

By this I assume you mean that you didn't select any services to be allowed correct?

Quote:

---

I was wondering if it was possible/likely I have been rooted (im new incase you hadnt guessed) or if something horribly wrong has happened, also what can I do about it? If I have been rooted is there any way to recover/change the root password (I have a restricted account that still works fine) and also is there anyway to see if anyone has got in and secure the system to stop future attacks? Any help would be greatly appriciated as I dont want to have to re-install as I have of yet no backup medium :( Thanks

---

On Most Linux systems, you can boot from a bootable Linux CD and do it that way but SUSE has extra security precautions in place as to not allow this as easy. I really don't think you're rooted as you have the hardware firewall there which wouls stop most of the things you would face from not having it updated as you booted up.... My only guess is what the other person said, you probably changed the root password, or you mis typed it twice.

Now, you have NO back ups medium? No CD burner? No Floppy or ZIP disks? If you have another machine just set up FTP on it and grab them that way.

As silly as it may sound, but it does happen frequently, did you try the password with "Caps Lock" on and then off?

cheers

Why don't you just boot into single user mode and change the root password? :confused:

grub howto: http://mm.ilug-bom.org.in/pipermail/...09/006090.html

lilo: http://wiki.linuxquestions.org/wiki/Single-user_mode

Heehee I sound like an idiot (probably quite acurate too :)), I checked the caps key wasnt on and I have never changed the password since setting it in the first place and I have frequently su'd whilst trying to set up the net connection so i know the password was correct, and like I said in my original post i re-typed it many times very slowly.

In answer to gore, yeps I mean no services allowed by the firewall and as for the backup nope to all of those at the moment, however once I have formatted one of the old computers FTP will be possible.

Thanks for the single user info Phatdee ill try that when I get in :)

I wasnt sure if it was a security problem or not but I wanted to make damn sure if it was it got sorted.