Linux Hacked

[vibhory2j]

Hi,

i am new to linux and i have just Red Hat linux 7.3 on a system in our computer lab. the problem is that someone has somehow.... i don't how.....has managed to change the runlevel of the linu system such that whenever the system goes to shut down it first goes into maintenance mode (runlevel 1).

from the maintenance mode shell i have to give the shutdown or reboot command....the problem is that this way anybody could easily change any settings of linux. i have tried reading all the scripts but didn't got it.

any help....

thanks in advance

[dragoncity99]

U can change back the runlevel back to runlevel 3 or 5 depending on ur flavour for GUI/Text Mode. To do this,

1. Goto /etc/ directory u will see a file called "inittab"
2. Open with ur favourite text editor.
3. U will see a line looks like this:

   ca::ctrlaltdel:/sbin/shutdown -t3 -r now ---> see if it's like this or any alien commands on it.

Check ur /etc/rc.d/ directory scripts.
Also check ur "cronttab" under /etc/ directory as well.
Lastly check ur /root/ directory on all the hidden scripts with leading dots '.' such as ".bash_logout"

[neo]

There is a very simple way to get control of root in linux by way to passing arguments at lilo or gruf booting. Just passwd protect your lilo or grub so that no one can send any parameters to the kernel at boot up. This will ensure that it does not happen again.