Re: Can't remove file as root

From: Bob Lawson (blawson@parkridge.on.ca)
Date: 02/23/02 

From: blawson@parkridge.on.ca (Bob Lawson)
Date: Sat, 23 Feb 2002 15:14:23 GMT

On Sat, 23 Feb 2002 13:29:33 +0100, Teddy <bla@bla.bla> wrote:

>I have the problem, that I can't remove a file as root anymore, and I
>don't know why. The file was replaced by a hacker.
>
>root@host:/bin # ls -l ps
>-rwxr-xr-x 1 root root 13583 Feb 9 01:04 ps
>root@host:/bin # rm ps
>rm: remove `ps', overriding mode 0755? y
>rm: ps: Operation not permitted
>root@host:/bin # chmod 0700 ps
>chmod: ps: Operation not permitted
>
>Thanks for Help
>
>Teddy
To be totally sure you must reinstall/recover from backups.

It sounds line they might have changed the userid of root, so although
you are loggin in as root you do not have root permissions. Root
might have been changed to another user.

Check the password file for this. You can fix it by booting off the
emergency boot diskette and editing the password file.

Bob Lawson
Parkridge Consulting
Innovative Unix & Linux Solutions
Visit us at www.parkridge.on.ca
blawson@parkridge.on.ca

Relevant Pages

  • Re: changing root account name
    ... Subject: changing root account name ... >>> superuser account to be the first line in the passwd file? ... Some versions of Unix are not driven directly off the password file ...
    (Focus-Linux)
  • Re: Locked Out of FreeBSD 5.2 - Newbie
    ... >are owned by toor instead of root. ... toor is a plain vanilla /bin/sh login with no bells and whistles. ... and in the password file there should be root ... >> you a bourne shell prompt. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: KUser corrupts /etc/passwd under Freebsd 5.2.1 ??
    ... Anytime you manipulate the password file USE ... The root passwd shoul look like this in master.passwd ... Use ONLY vipw to edit the password file. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: HowTo Disable execution of commands whit ssh and scp/sftp
    ... > give you a fair slice of the password file in a different form. ... > a limited set of commands as root. ... command, and only that one! ... # ssh sshuser@localhost ...
    (Fedora)
  • Re: Locked Out of FreeBSD 5.2 - Newbie
    ... I tried doing what you said, ran into some editing ... The root line contains the information related to me trying to set it up as ... Now, should I be replivating the toor line, change toor to root and then ... and in the password file there should be root ...
    (comp.unix.bsd.freebsd.misc)