Friday, August 27, 2004

R00T access

Gaining root access is one of the most important preventive actions an administrator can protect from. Obviously if the main system is ran in Admin mode this will prevent someone else from remotely logging into the system and gaining access, then the issue is how secure the physical premises.

If you have forgotten your root password though there are ways of dropping a system into a shell environment and resetting the root password in /etc/passwd. If LILO is used the first step is to try and boot into single user mode by typing LILO: Linux single. This should give you shell access to go into the passwd file and change the passwd for root. If LILO asks you for a passwd then you're working with a sharp admin whose password protected LILO. As a possibility try hitting ^C which might drop you to a root prompt, unless of course the same sharp admin has trapped the ^C access. In which case the last option to try is to go back into the LILO prompt and type LILO: Linux init=/bin/bash what you are telling the kernel is to give you a shell.

After gaining shell access it's possible that somethings can't be found due to being on a filesystem or disk which isn't mounted yet or it is on a read only mounted filesystem. These steps should help get around this:
mount -o remount, rw ' remount / readable and writable
mount -a ' mount all
mount ' show mounted filesystems
vi /etc/passwd ' clear the password for root
sync ' write buffers to disk
umount -a ' unmount filesystems
mount -o remount, ro / ' remount / read-only again

Ctrl Alt Del login: root ' login as root without a password


If you are using GRUB instead of LILO the RED Hat site has these steps which should work for you to gain a shell. At the selection menu highlight the linux entry and type e for edit. Arrow down to the line which starts the kernel and type e to edit the line. Go to the end of the line and either type single or type init 1 and hit enter to exit edit mode. back at the GRUB screen type b to boot up into the mode you selected. This should get you into a shell where you can vi into /etc/passwd and change the root passwd.

Monday, August 23, 2004

Troubleshooting

The recent spat of SSH scans have been identified as a program called bruteSSHd which tries to brute force SSH passwords. Brute forcing passwords is simply a program which will try a combination of password retries until the right password is found. This is one of the security issues SSH has in that to the best of my knowledge there is no way to limit the number of failed logins under SSH.

Some other Troubleshooting tips are as follows (most can be found here):
If you get the error msg: "Secure Connection Refused" This is usually a configuration issue. Somewhere within the installation of SSH a wrong parameter was given which currently has SSH looking for an RSH parameter. The easiest thing to do is reinstall SSH.

SSH asks for passwords despite an .rhosts file. This error can be linked to a number of issues regarding the configuration files, whether they are readable or set up properly.

X11 Forwarding problems - check the command line you are using, the proper command line for X11 connections is ssh -f otherhost xclient. Also, check the configuration files on both sides to verify everything is configured properly.

To return to the main directory for the SSH Tutorials.