5

On Fedora, root is coming up invalid. WHat is solution?

Improve this question
1

7 Answers 7

Reset to default
15

If it were a simple "password lost" issue, I'd follow the other advice.

Seeing as it was a hack, the solution would be wipe and restore from known good backup. You'll never know if you fully cleaned it and eliminated rootkits and backdoors.

Improve this answer
6
  • ....unless you've got a properly configured host-based IDS (but then I supose the question would never be asked ;)
    – symcbean
    Jun 24, 2010 at 15:05
  • 3
    Even so...I think IDS is more like a confirmation of "OH @#%!", as I would have a nagging feeling I could be missing something if I didn't wipe and reinstall. I know, IDS should work, but there could be some way that it was tampered with or, once they get in, could have altered something with a kernel module that even the IDS lost track of something at some point. Safer to nukeitfromorbit.
    – Bart Silverstrim
    Jun 24, 2010 at 15:48
  • If you restore from old backup, be sure to CHANGE YOUR ROOT PASSWORD AS SOON AS POSSIBLE!
    – Weboide
    Jun 24, 2010 at 22:08
  • Restoring a backup won't magically fix the initial attack vector they used to hack your site. All the attacker needs to do is run through whatever exploit they used again and your server is their again. For that reason, grab the old files first so you can analyse the logs and then find the problem, then cut it off. Set up some sort of firewall so only you can touch the server, wang it back on, wipe, restore, compare, fix, go live.
    – Oli
    Jul 20, 2010 at 14:17
  • couldn't have said it better myself.
    – grufftech
    Jul 20, 2010 at 14:54
7

First of all, shut it down until you figure out what to do. There's nothing more annoying for a hacker that the server he just hacked is now down!

Improve this answer
1
  • 6
    Or disconnect it from every network (physically).
    – Chris S
    Jun 24, 2010 at 12:39
4

Nothing that we can do.

If you have bare-metal access (or access to somebody that does), you should be able to boot into single user mode (aka rescue mode) as root and then reset the root password.

Needless to say, you need to limit internet access to this until you've fixed everything.

I've seen a few people saying restore to a backup is the only way to get clean. Restoring a backup isn't the whole solution. That gets your attacker back outside and stops your machine doing anything evil on their behalf.

The main problem after an attack is there's still a vector into your machine. Before you nuke your old install, grab the logs, databases, web files, etc. If it's a recent backup, diff all the files so you can see any changes. Look in the logs to see what IPs were attacking what. You need to find out how they got into your machine or you'll get re-hacked within minutes of going live.

Improve this answer
1
  • This is a good way to get back in, but don't think that you can fix the server. Once it's been hacked you need to wipe it clean and restore from a known-good backup (and if you didn't take backups it's time to start from scratch).
    – Chris S
    Jun 24, 2010 at 12:38
1

If it is possible to boot from a medium such as USB or CD, download and run a LiveCD. Then you can make a new password for the machine by chrooting into it and issuing passwd root afterwards to give the root user a new password.

Though I would be very causious about what files and other stuff you back up. Preferably you should reinstall the machine and on the new install you should rethink your security on the server and make it tougher for the people to just hack it.

Improve this answer
1

You will need physical access, at your boot prompt pass "init=/bin/sh" then mount the filesystems you need (/ for sure needs to be remounted readwrite) and change the password back. Once that's done, reboot.

Now you should be aware that you may not have access to the system back, considering you suspect the machine was compromised, you have other work you need to do to ensure that your system is sane. Try and identify when it was breached, and assume everything after that point has been tempered with, go back to a known secure point in time and restore those backups.

Improve this answer
0

Solution is load LiveCD system on this machine for read/write disk mount and change configuration on system (eg. /etc/passwd and /etc/shadow) for allow root user logon on this system and set for her password or get his hard-drive on other machine.

Improve this answer
1
  • 1
    If, as the OP states the machine was compromised, this is not a sufficient answer. Once a machine is hacked you can't trust that they didn't leave a back-door for themselves or other damage.
    – msw
    Jun 24, 2010 at 11:33
0

Boot from a different OS (LiveCD, USB, etc. - anything that was not connected to the machine previously). Save your documents, sources and anything else that is not an executable binary. Format the machine and install everything from scratch.

Once a machine has been compromised, you can't clean it up. The bad guy owns it; your only solution is to wipe it up.

Improve this answer