recovering root password

[l_linuxguru]

if my system get hacked and someone change root password how can i recover my root password again..
plz help

[Dolda2000]

Just boot your kernel with the kernel command line "init=/bin/sh". That way you'll be able to run passwd to change it back.
Did you get hacked?

[l_linuxguru]

Just boot your kernel with the kernel command line "init=/bin/sh". That way you'll be able to run passwd to change it back.
Did you get hacked?

yep
can u guide about some securities issue.

[Dolda2000]

Sorry, not now. It's 5 AM over here and I'm going to bed now. Please describe what it is that you want to know and I'll write about it tomorrow.

[l_linuxguru]

Sorry, not now. It's 5 AM over here and I'm going to bed now. Please describe what it is that you want to know and I'll write about it tomorrow.

i m running cable net my server is linux 7.2 and this is the second time i got hacked.
plz tell me how to make my system secure.how to close extre ports etc.

[genlee]

Update to a later version of redhat. Do not use the default install. Setup iptables. Run services in a chroot enviroment.

[andutt]

On normal bootup press ctrl + x when your lilo or grub bootloader apears, the use the tab-button to see which kernels you can boot from. Then type:

boot <kernelname> single

to boot to singleusermode, the use the passwd command to set a new root-password. You dont have to type the oldone in singleusermode.

Regards

[Dolda2000]

Actually, the Ctrl-X and tab stuff only works in LILO. GRUB has a completely different approach. Also, you only type <kernelname> single, not boot <kernelname> single.
Btw. andutt, are you sure you can really give it "single"? The only things documented in init(8) is to give it a numerical runlevel. If so, you'd have to enter <kernelname> 1.

[andutt]

You are absolutly correct dolda, you can NOT type:

boot before <kernelname> single

Typo from me, yes you can specifie single after the specified kernelname. (rescue, emergency) if you are booting from a cd-rom from your distributer.

The good thing is that init is not involved in this step, If your init is coruppted and or not working you still can boot your system and mount your root filesystem in readonly mode with almost nothing loaded to try to fix the problem. This is a support in the kernel.

I was a little fast answering on this, so dolda is correct on the grub stuff to. My post above only works on lilo. If you are using grub do like this:

If you have a GRUB password configured, type p and enter the password.Select the kernel that you wish to boot and type e for edit. You will be presented with a list of items in the configuration file for the title you just selected.

Select the line that starts with kernel and type e to edit the line

Go to the end of the line and type single as a separate word (press the [Spacebar] and then type single). Press [Enter] to exit edit mode.

Back at the GRUB screen, type b to boot into single user mode.

Thats it, Regards

[Dolda2000]

Really? You're saying "single" as a kernel option? The effect of it does look very similar to specifying "init=/bin/sh". Do you know exactly what it does?