RE: [cobalt-users] I can't telnet, or from serial port.

[John M Troher <admin@xxxxxxxx>]

I had the SAME problem,  here is what you need to do

1st you have been hacked, and someone has probably
changed the permission on the /bin/login so you cant get
in, BUT they most likely installed SSH so they can get in.

What I had to do was find what port they put SSH on, So I
ran a port scanner on my box from port 1 to 64000 and bingo
I found SSH running on port 47777  I was then able to connect
with my favorite SSH client and regain root access.

Then the fun began, I had to find all the files they changed
permissions one etc. Like login and ps and netstat, I had to
chown them all back to owner/group root.

Once I returned ownership of login to root I was then able to
telnet back in.

Try that and hope that they didnt delete login or bash

John

-----Original Message-----
From: Kevin D [mailto:kdlists@xxxxxxxxxxxxxxx]
Sent: Saturday, March 03, 2001 10:15 AM
To: admin@xxxxxxxxxxxxxxxxx
Subject: Re: [cobalt-users] I can't telnet, or from serial port.


> Brief, and quick help needs.  I can't telnet to Cobalt Raq 3 [all patches
is
> currently updated], via internet, or serial port, it said 'unable to load
> interpreter'.

It sounds like either /bin/bash or /bin/login is corrupted. If the GUI works
try to find a .pkg with bash and login. There's a .pkg available for SSH,
and maybe that would allow you to login and restore the proper files.
Failing that, you could mount the HD on a linux box and restore the files
from Red Hat RPMS. Your last resort would be the restore CD.

Kevin

_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users