[plug] Help with SU

[Phillip Bennett]

I'm doing a check right now.  Can anyone suggest a good kit for this?  I'm
sure there's some better than the rest...
 
Phil.
 

  _____  

From: Daniel Pearson (Flashware Solutions) [mailto:daniel at flashware.net] 
Sent: 30 March 2007 16:58
To: plug at plug.org.au; phillip at mve.com
Subject: Re: [plug] Help with SU


No worries :-D

Is it worth doing a check for a rootkit? Have any other files done odd
things?

Phillip Bennett wrote: 

Sorry Daniel.  I saw Mark at the top and addressed that to the wrong person.



Apologies,

Phil.

 



-----Original Message-----

From: plug-bounces at plug.org.au [mailto:plug-bounces at plug.org.au] On Behalf

Of Daniel Pearson (Flashware Solutions)

Sent: 30 March 2007 16:24

To: plug at plug.org.au

Subject: Re: [plug] Help with SU



Mark O'Shea wrote:

  

On Thu, 2007-03-29 at 14:46 +0100, Phillip Bennett wrote:

  

    

However, now I can't su to root.  It gives me a 'wrong password' error.

Fortunately, I can still use 'sudo su -' to get root.

    

      

  

    

Can anyone shed any light on why this would happen?  Or at least 

where to look?  I've checked the PAM files and the nsswitch.conf.  

There's nothing in any of the logs (messages, secure etc..)  I'm 

completely stumped.  I thought I knew how logging in worked, but I 

guess I've missed something fairly important.

    

      

Curious.  There's *nothing* in the logs for the auth facility (check 

where it's going in the config for your syslogd, whichever one you 

use) for su? Not even for the successful ones executed under sudo?



It sounds like you can authenticate okay for everything apart from su 

using local password files now that your not going through kerberos to 

authenticate to ad.  This does suggest pam config, maybe things are 

out of order.  What does the pam config for su actually say?



  

    

What about sudo passwd root ?

_______________________________________________

PLUG discussion list: plug at plug.org.au

http://www.plug.org.au/mailman/listinfo/plug

Committee e-mail: committee at plug.linux.org.au



_______________________________________________

PLUG discussion list: plug at plug.org.au

http://www.plug.org.au/mailman/listinfo/plug

Committee e-mail: committee at plug.linux.org.au



  

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.plug.org.au/pipermail/plug/attachments/20070330/03b3f67a/attachment.html>