Random Change of Password?

Nefarious · 1 Sep 2008 at 02:54

I have a box running Xebian and I can no longer SSH into it.

It would seem that the password has changed and yet I didn't change it... what am I to do?

The last thing that I remember doing that may have had an impact was some file modifications and changing root's home folder but that shouldn't have done this.

I have NAT on my router so doubt someone could have hacked it, any ideas?

Nefarious · 2 Sep 2008 at 08:44

Due to what I used it for - there was only root (at least if I did set up other accounts I've forgotten about them by now)

I thought I wasn't able to reset the password at lower run levels? AFAIK I thought the only way to recover from this was to remove the main drive, rewrite the security descriptors for the drive and delete the root password - other ideas?

Nefarious · 4 Sep 2008 at 01:48

That's the thing - SSH should not be possible from WAN. All inbound services are denied other than IM and BT.

It's quite a puzzler... The only thing that I can think of, given the fact that my router seems to be unaffected, is that they hacked a windows machine on my network which then went on to do naughty things but that seems awfully convoluted and over the top for my warez etc

Nefarious · 7 Sep 2008 at 03:18

I don't have access to a USB adapter at the moment so can't attach a keyboard so am going to try an SSH brute force to get back in over the network, anyone have any recommendations?

I tried Arudius Live CD but it didn't seem to work with my computer's onboard NIC card or my wireless card. Does it not auto configure the cards or....?

Nefarious · 7 Sep 2008 at 04:19

Right... I configured my cards (really not used to the slackware ways) and even got airsnort working which was interesting.

I spent ages trying to work out why it wasn't playing ball and eventually found out that the cross over patch cable was at fault, grrr. I think I'm going to call it a night for now.

As far as the Arudius package goes - it's damned cool. I'd have prefered in a different flavour of Linux but that's just because I know very little of slackware. Had a bit of a play with some of the bits of software and they might come in useful at some point.