Linux

Ask something
Discussion Locked

Linux - Samba password problem

0 helpful
4 replies

by trule

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We've got a linux box running Samba, atalk,
nfs, etc etc. for a catholic high school
(which means VERY limited time to fix things
!)

We were hacked 2 years ago. Before our
'friend" attacked us, we could have students
use passwd to change their password, and it
would change their samba password as well.
Now, the two passwords are separate. Trying
to run smbpasswd gives an error

smbpasswd: machine 127.0.0.1 rejected the
session request. Error was : code 131.

So why is it trying to check with 127.0.0.1?
What can we do

4 replies

by zbrain75

The 127.0.0.1 number is your network card loopback address, normally used for testing and some other things, but obviously for smbpasswd. It's possible that one or more or the passwd or smbpasswd programs were changed. Possibly the command "passwd" or "smbpasswd" is really running a script and then calling other programs.

It's just some possibilities to check. I'd do a "locate smbpasswd" then look at all copies of the file with that name to see if they are binary or script programs. Dothe same for passwd.

If you're using the smbpasswd command through a remote session such as telnet, try it on the local console.

If you have any problems there is a Linux Users Guide and other Linux manuals at:
http://ctdp.homestead.com/files/os/linux/index.html

Section 8 of the User's guide talks about finding files with the locate command. Also the Web links has some good links to useful Linux documentation including the Linux Documentation Project.

by zbrain75

Actually the best thing to do in my opinion, is to save your useful programs (not installed with the systems or ones that can't be reinstalled) data files, and reinstall the system.
This is because the hacker could have left behind trapdoor or trojan programs that could enable them to get back in, or your system may send your system information to the hacker. He may have even left a time bomb program that may remove files from your system. I don't mean to scare you, but if you've really been hacked then it's time to exercise caution to prevent the occurance again.

This discussion is closed to new replies.