From owner-freebsd-questions Mon Dec 15 16:34:51 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id QAA02240 for questions-outgoing; Mon, 15 Dec 1997 16:34:51 -0800 (PST) (envelope-from owner-freebsd-questions) Received: from mail.netcetera.dk (root@sleipner.netcetera.dk [194.192.207.2]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id QAA02210 for ; Mon, 15 Dec 1997 16:34:44 -0800 (PST) (envelope-from leifn@image.dk) Received: (from uucp@localhost) by mail.netcetera.dk (8.8.8/8.8.8) with UUCP id AAA09677 for freebsd-questions@freebsd.org; Tue, 16 Dec 1997 00:00:24 +0100 Received: by swimsuit.roskildebc.dk (0.99.970109) id AA07894; 15 Dec 97 23:59:17 +0100 From: leifn@image.dk (Leif Neland) Date: 15 Dec 97 23:32:40 +0100 Subject: reject to boot Message-ID: <639_9712152359@swimsuit.roskildebc.dk> Organization: Fidonet: UNIX-sysadm søger job To: freebsd-questions@freebsd.org Sender: owner-freebsd-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk At 15 Dec 97 12:42:24 Uno.Fors@mip.ki.se wrote regarding reject to boot U> We have a serious problem in that someone from outside revealed U> the root password and "tookover" the machine. When we try to boot U> from diskette it goes to stop with a black screen before it comes U> to the menu with choices. Do you have any idea on what could have U> caused this. Can the intruder have made any change to the kernel U> or something so that the system is unabled to boot from U> diskette??? You should be able to boot from the bootstrap-diskette, as it doesn't use the stuff on the hd until it tries to mount the root. Can the machine boot from hd? Do you get the boot: prompt, so you can enter -s to go to single-user? I would make a fresh installation floppy, and upgrade the whole system, in case hacked executables are installed, and then double-check what is run from inetd and misc rc-files. Leif Neland leifn@image.dk --- |Fidonet: Leif Neland 2:234/49 |Internet: leifn@image.dk