Find the answer to your Linux question:
Results 1 to 6 of 6
Hello Forum: I am having a problem with two linux boxes I have. They are running Centos 5.3 and Centos 5.4. The problem is that when I log in, this ...
  1. 02-19-2010 #1
    wbens
    wbens is offline
    Linux Newbie
    Join Date
    Jun 2008
    Location
    Georgia, USA
    Posts
    117

    Logging Reveals Username and Password

    Hello Forum:

    I am having a problem with two linux boxes I have. They are running Centos 5.3 and Centos 5.4. The problem is that when I log in, this file /etc/host, under the etc directory get appended the username I am logging in as, the IP address I am logging in from, and worse, the password in clear text.

    This is the format it uses:

    username@IP (password in clear text) [Tue Jan 12 2010 13:00:26 -0500]

    Is it possible for someone to tell me what is this about, and how to stop it?
    Thanks.
    --Willie
    If there was no Linux, my life would not be complete.
    Reply With Quote Reply With Quote
  2. 02-20-2010 #2
    Rubberman
    Rubberman is offline
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    Location
    I can be found either 40 miles west of Chicago, or in a galaxy far, far away.
    Posts
    8,974
    What are the permissions on this file? Only root should have read access to this file. If that is the case, then I think it is functioning as designed. I assume these logins are via ssh?
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!
    Reply With Quote Reply With Quote
  3. 02-23-2010 #3
    wbens
    wbens is offline
    Linux Newbie
    Join Date
    Jun 2008
    Location
    Georgia, USA
    Posts
    117
    The permissions are:

    -rw-r--r-- 1 root root 527 Feb 23 14:27 /etc/host

    However, notice that this file is not the /etc/hosts file. I have never seen this file in a Centos box before.

    I am logging via ssh.

    What do you think could be happening?
    Thanks.
    --Willie
    If there was no Linux, my life would not be complete.
    Reply With Quote Reply With Quote
  4. 02-24-2010 #4
    IsThisNecessary
    IsThisNecessary is offline
    Just Joined!
    Join Date
    Feb 2010
    Posts
    5
    Quote Originally Posted by wbens View Post
    The permissions are:

    -rw-r--r-- 1 root root 527 Feb 23 14:27 /etc/host

    However, notice that this file is not the /etc/hosts file. I have never seen this file in a Centos box before.

    I am logging via ssh.

    What do you think could be happening?
    I don't think your password should be readable, so this could be malware of some kind. Check for login scripts, sshd_config and verify sshd.
    Reply With Quote Reply With Quote
  5. 03-12-2010 #5
    wbens
    wbens is offline
    Linux Newbie
    Join Date
    Jun 2008
    Location
    Georgia, USA
    Posts
    117
    This turned out to be a rootkit. I think it was a java rootkit. I had to rebuild the server from scratch. I wonder if it is possible to delete any rootkit. If anyone of you knows out there, please let me know.

    Thanks.
    Thanks.
    --Willie
    If there was no Linux, my life would not be complete.
    Reply With Quote Reply With Quote
  6. 03-13-2010 #6
    kurtdriver
    kurtdriver is offline
    Linux Newbie
    Join Date
    Oct 2008
    Posts
    140
    Quote Originally Posted by wbens View Post
    I wonder if it is possible to delete any rootkit. If anyone of you knows out there, please let me know.

    Thanks.
    Overwrite everything. Sorry for the bad news.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules

...