[cobalt-users] Recent Hacks - root needs a shell?

["fastmedia" <inc@xxxxxxxxxxxxx>]

is this line in /etc/passwd normal?

[root@www uninstallers]# cat /etc/passwd
root:x:0:0:Root:/root:/bin/sh



i suspect it's correct, just checking in case the /bin/sh has been put in by
the hax0rs