A strangely compromised Linux box

“When I arrived on site, I found that I could not login as he
had said. I rebooted to single use mode and started peeking around.
The machine had been hacked; there was little doubt about that.
It’s HOW it was hacked that bothers me,

“First, there was no attempt to hide any evidence. I could see
in wtmp and the secure logs that someone had logged in from a
German ISP address, attained su status, and created a new su user
for himself. He then changed root’s password.

“Fine so far, right? But then he did something very strange. He
hand edited /etc/passwd and added “/nologin” at the end of each
line except root and his own. This was what was preventing people
from logging in.

Why do that?”


Get the Free Newsletter!

Subscribe to Developer Insider for top news, trends, & analysis