Re: [vox] What happens internally to Linux when it is in password limbo?

[Samuel Merritt <snmMAPSerritt@ucdavis.edu>]

On Fri, Mar 15, 2002 at 11:10:12AM -0800, Danny Webster wrote:
>     The sendmail on a 200MHz recently slowed to a crawl on a Red Hat 6.1
> system.  Authorization took up to 3 minutes on machines running Outlook
> Express.  The day after I changed the root password from an easily guessable
> password, the machine had all the speed you could hope for.  But since I
> have not yet restarted any of the services or rebooted, the old password
> still works even though through linuxconf the password has been changed.
> Does this make any sense to anyone?  

That doesn't make any sense. When you log in, the password is tested 
against a string in /etc/passwd (or /etc/shadow). The password change 
should take place instantly; the old should stop working, and the new one 
should start. The kernel doesn't keep track of any passwords. 

That this hasn't happened indicates to me that Linuxconf isn't actually 
changing the password for some reason. 

Try this: As root, run "passwd" to change the password, rather than 
relying on Linuxconf. If, after doing this, you can still log in to the 
machine with the old password, something is very wrong, and it may 
indicate that the machine has been compromised. 

-- 
Samuel Merritt
PGP key is at http://wwwcsif.cs.ucdavis.edu/~merritt/snmerritt.asc
Information about PGP can be found at http://www.mindspring.com/~aegreene/pgp/

Attachment: pgp00001.pgp
Description: PGP signature