Re: [cobalt-users] RaQ4 - have I been hacked?

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"Edward Bishop" <eddie@xxxxxxxxxxxxxxxx> wrote:
> No user can log in using FTP - their passwords are rejected.

Have any packages been installed or configuration files been edited?

> Passwords are working OK for POP and SSH - ie I can log in as any user
> by SSH.
> A few strange-looking files have appeared in /etc:
>
> group-
> gshadow-
> passwd-
> shadow-
>
> Note the hyphens; the original files without hyphens are there as
> well. Is this normal?

Those files are normal.  They are backups of the original files and are
created automatically when the live versions are edited.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/