Entries in `/etc/inittab` below last line - possible hack? [closed]

Posted by Danijel on Server Fault See other posts from Server Fault or by Danijel
Published on 2012-10-05T11:59:42Z Indexed on 2012/10/06 21:40 UTC
Read the original article Hit count: 196

Filed under:

linux

|

rootkit

|

inittab

Possible Duplicate:
My server's been hacked EMERGENCY

My Linux machine has been hacked lately.

There are a few entires in /etc/inittab below the

#end of /etc/inittab

Something like:

#Loading standard ttys
0:2345:once:/usr/sbin/ttyload

I also have serveral of the following lines:

2:2345:respawn:/sbin/mingetty tty2
3:2345:respawn:/sbin/mingetty tty3
.
.
.

I know that my /usr/sbin/ttyload has been hacked, and I have removed it, but I don't know if I need this is inittab, nor whether I had ttyload before. Is this file common?

Should I remove this line?

© Server Fault or respective owner

Related posts about linux

apt-get install and update fail

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I've got a problem with apt-get update and apt-get install ... commands . every time update or installing fails and errors are : Get:1 http://dl.google.com stable Release.gpg [198B] Ign http://dl.google.com/linux/chrome/deb/ stable/main Translation-en_US Get:2 http://dl… >>> More
kernel module compiling error

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
sh@ubuntu:/home/ccpp/helloworld$ make gcc-4.6 -O2 -DMODULE -D_KERNEL_ -W -Wall -Wstrict-prototypes -Wmissing-prototypes -isystem /lib/modules/`uname -r`/build/include -c -o hello-1.o hello-1.c hello-1.c:4:0: warning: "MODULE" redefined [enabled by default] <command-line>:0:0: note: this is… >>> More
Build-Essentials installation failing

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am having trouble accessing the several critical header files that show to be a part of the build process. The "Ubuntu Software Center" shows "Build Essentials" as installed: Next I did the following two commands, which did not improve the problem: ~$ sudo apt-get install build-essential [sudo]… >>> More
Updating Debian kernel

as seen on Super User - Search for 'Super User'
I'm trying to update my Debian machine to 2.6.32-46 (which is the new stable). However, after doing apt-get update my apt-cache search linux-image shows me: linux-headers-2.6.32-5-486 - Header files for Linux 2.6.32-5-486 linux-headers-2.6.32-5-686-bigmem - Header files for Linux 2.6.32-5-686-bigmem linux-headers-2… >>> More
Serial connection over a single USB cable (Windows to linux, or linux to linux)

as seen on Server Fault - Search for 'Server Fault'
I'm helping out with a project for an embedded device that only has USB and no serial. This device is running Linux. These days, when we need to connect to a serial port on a device we typically use a USB to serial adapter (on something like a phone system or a load balancing device, etc). I would… >>> More

Related posts about rootkit

Rkhunter 122 suspect files; do I have a problem?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am new to ubuntu. I am using Xfce Ubuntu 14.04 LTS. I have ran rkhunter a few weeks age and only got a few warnings. The forum said that they were normal. But, this time rkhunter reported 122 warnings. Please advise. casey@Shaman:~$ sudo rkhunter -c [ Rootkit Hunter version 1.4.0 ] Checking… >>> More
Microsoft Says Rootkit Causes XP 'Blue Screens'

as seen on Internet.com - Search for 'Internet.com'
After a week-long investigation, Microsoft bug sleuths claim they've hunted down the cause of multiple reboots and crashes inflicted on Windows XP users. >>> More
Latest Microsoft Patch Aims To Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
Patch meant to kill off 17-year-old bug was suspected of causing multiple crashes and continuous reboots, but the problems were traced to a rootkit. But since the patch won't install on infected systems, what will users do now? >>> More
Latest Microsoft Patch Aims To Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
Patch meant to kill off 17-year-old bug was suspected of causing multiple crashes and continuous reboots, but the problems were traced to a rootkit. But since the patch won't install on infected systems, what will users do now? >>> More
Microsoft Redux: Windows XP Patch Back to Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
The software giant re-releases the bug patch that some Windows XP users blamed for repeated restarts and blue screen crashes following February's Patch Tuesday release. >>> More