Date: Mon, 18 Jun 2012 10:42:59 -0400 From: Jason Hellenthal <jhellenthal@dataix.net> To: Budnev Vladimir <vladimir.budnev@gmail.com> Cc: freebsd-security@freebsd.org, freebsd-questions@freebsd.org Subject: Re: (Free 7.2) "su -l" didnt prompt password.Is it possbile? Message-ID: <20120618144259.GB74775@DataIX.net> In-Reply-To: <4FDF2DCA.2020105@gmail.com> References: <4FDF2DCA.2020105@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jun 18, 2012 at 05:31:54PM +0400, Budnev Vladimir wrote: > Hello everyone. > We'v noticed some strange situation. After reboot and login, system > didn't ask for password while switchig with su -l. > > In details, there was root login from terminal and one from ssh. > Terminal login was directly as root(via ip-console), and ssh was as > user, then attemped switch to root with su -l, and there were NO > password request,no prompt at all. At the same time login from terminal > accepted root password, first I thought that means password wasn't > empty, but system even with empty password should print "Password:"..and > that time it was nothing absolultey. We even logged out and then su -l > again. > > And It looked such way: > > %su -l > St-serv# > St-serv# exit > %su -l > St-serv# > > We'v been shocked and hurried a bit and changed root password without > /etc/master.passwd backup for explorations. > After chagning password we cant no reprocude such behaviour. > > It's also should be noticed that system was booting after unsafe power > shutdown, and there was fs-check running in background(accroding to > logs), corrected cleared some files(searching by inum resulted to nothing). > > sysctl -a gave such string: > <118>Starting background file system checks in 60 seconds. > <118> > > and in /var/log/messages we could see: > Jun 15 14:57:39 St-serv kernel: em0: link state changed to UP > Jun 15 14:57:49 St-serv login: ROOT LOGIN (root) ON ttyv0 > Jun 15 14:58:47 St-serv fsck: /dev/ad0s1e: 71 files, 11 used, 2538508 > free (84 frags, 317303 blocks, 0.0% fragmentation) > Jun 15 15:02:31 St-serv fsck: /dev/ad0s1f: 264646 files, 1378041 used, > 60368113 free (43545 frags, 7540571 blocks, 0.1% fragmentation) > Jun 15 15:03:31 St-serv su: zimmer to root on /dev/ttyp0 > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: INCORRECT BLOCK COUNT > I=1931747 (897632 should be 897600) (CORRECTED) > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: INCORRECT BLOCK COUNT > I=1931748 (1865184 should be 1865120) (CORRECTED) > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: INCORRECT BLOCK COUNT > I=2284637 (4 should be 0) (CORRECTED) > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: INCORRECT BLOCK COUNT > I=2284713 (4 should be 0) (CORRECTED) > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: UNREF FILE I=23557 > OWNER=root MODE=100644 > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: SIZE=0 MTIME=Jun 9 18:51 > 2012 (CLEARED) > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: UNREF FILE I=1931319 > OWNER=root MODE=100640 > Jun 15 15:03:43 St-serv fsck: /dev/ad0s1d: SIZE=728 MTIME=Jul 26 17:37 > 2011 (CLEARED) > <...> > > > I'v googled and found only one thread with su didnt'asking for password, > that one was abut jails, but this time we have a 100% garanty that we > didnt put any virtual enviroments. > > So the thing that scares is, mb this is symptop of server rootkit? (We'v > found nothing unusual in logs but it means nothing...) Or there is some > other explanation why su could not ask password? > The only thing I can think of ATM is .. did you recently perform and upgrade from source with this system ? mergemaster ? The reason why I ask is that when doing such things the master.passwd is compared to the default master.passwd which has no passowrd set. If a merge when wrong then there is a possibility that it was set back to defaults by accident. I also see that your system booted up and did a fsck(8). There is a chance that something wierd happened here as well. > > Thanks in advance > > PS Duplicated question to freebsd-questions and freebsd-security because > unsure which one it should be send. > > > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" -- - (2^(N-1))
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120618144259.GB74775>