RE: [cobalt-users] hacked raq

[Randy Davis <randy@xxxxxxxxxxxxx>]

I didn't notice last night (at about 5:45pm) that when I set out an update
it went to one person and not the whole list.  Basically, after using the
chattr command, I was able to reload the util-linux rpm and everything is
showing up cool with rpm -V and chkrootkit is showing clean bill of health.
Now I've got to get my tape drive fixed before something else happens!
Thanks all for your help!

Ciao
Randy Davis

-----Original Message-----
From: Gerald Waugh [mailto:gerald@xxxxxxxxx]
Sent: Wednesday, February 21, 2001 5:43 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Cc: Randy Davis
Subject: Re: [cobalt-users] hacked raq


"Randy Davis" <randy@xxxxxxxxxxxxx>  wrote

> Yepper.  Did try force as well.  Here is the actual error message I get
> back:
>
> # rpm -Uvh --force util-linux-2.10m-C1.i386.rpm
> util-linux
> can't rename /bin/login to /bin/login-RPMDELETE: Operation not permitted
> unpacking of archive failed on file /bin/login: cpio: unlink failed - Bad
> file descriptor
>
> Ciao
> Randy

Ok, look in /bin/login (ls /bin/login) and see if the file is there.
If it is not there
try "ls /bin/xlogin"
if it is there
You have been cracked.
(note: hacking is not bad (hackers built Linux) crackers are the spoilers
(bandits)!
Gerald