[WBEL-users] Password changing overnight.

[Graham Purcocks]

This is a multi-part message in MIME format.
--------------050307010505080205060207
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Sorry to mention this, but one other gotcha is the Caps Lock key. Most 
likely not that and your systems are compromised in some way, but just 
sometimes the simple reason is overlooked.

Kirby Bohling wrote:
> On Mon, Aug 16, 2004 at 10:38:50AM +0100, Denis Croombs wrote:
> 
>>I have a VERY strange problem some whitebox & Redhat 9.0 system change their
>>ROOT passwords overnight, (not very often) this is a real pain, any clues as
>>to why it should happen ? It also has happened for a normal user as well but
>>that is easier to cope with.
>>I am currently helping 1 school with 8+ whitebox systems and 1 Redhat 9.0.
>>This has happened 3 times in 3 weeks on the Redhat 9.0 and 4 times on
>>Whitebox system over the last 4 weeks.
> 
> 
> Denis,
> 
> 	Uhhh, in 9 years of running Linux, the only time my root
> password has every changed is when I did it, or someone broke into
> my machine and had some fun at my expense.
> 
> 	If there is no remote access, it's still relatively easy to just
> reboot into single user mode and change the password.  Unless you
> have some odd password expiration setup, someone is changing your
> root password.  Have you tried putting it thru an MD5 password
> cracker?  I know one was posted to slashdot in the past month or so.
> 
> 	Are you just using straight up /etc/shadow passwords with
> standard file based authentication?  What are the symptoms that lead
> you to believe the password has been changed (I've had several times
> where LDAP problems that timed out acted like a password change).
> 
> 	Thanks,
> 		Kirby
> _______________________________________________
> Whitebox-users mailing list
> Whitebox-users@beau.org
> http://beau.org/mailman/listinfo/whitebox-users

--------------050307010505080205060207
Content-Type: text/x-vcard; charset=utf8;
 name="grahamp.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="grahamp.vcf"

begin:vcard
fn:Graham Purcocks
n:Purcocks;Graham
org:WSI Ltd;Engineering
adr:Hockley;;22-24 Vittoria Street;Birmingham;W.Midlands;B1 3PE;U.K.
email;internet:grahamp@wsieurope.com
title:Consultant Engineer
tel;work:+44 121 233 7600
tel;fax:+44 121 233 7666
x-mozilla-html:FALSE
url:http://www.wsieurope.com
version:2.1
end:vcard


--------------050307010505080205060207--