37 replies to this topic

[antoine3_dupres]

Dear all,

 

Something weird I discovered today.

In the past I had a password for the user root, but I realised today there is none anymore.

I can login to the box with the user root, and teh system doesn ot even prompt for a password.

 

I tried to to "passwd" with the root account, the system asked me the new password twice, but still after that, I can still telnet with no password!

 

Any view?

 

I have a vu plus duo running open pli 4.

 

Regards,

[antoine3_dupres]

I fixed it. Iedited the passwd file an added a x on the root line between the 2 :

There is another issue it was there before i editedthe passwd file.

After some time after reboot, i cannot telnet to the box anymore.looks like the telnetd daemon is dying after some time.
Is there a log that would contain the reason?
Thanks.

[MiLo]

Maybe someone was "administering" your box from the outside?

[theparasol]

That was my first thought too... those things like "cannot change password", "telnet dies", dont happen out of the blue due to some hardware failure or software failure.

[antoine3_dupres]

Thxs for the warning.
I will monitor the situation.
How could i stop telnetd to die.

[christophecvr]

I suggest You first take a backup off settings only and channels settings. Avoid using a backup programma now as it's possible that someone entered you're box from the out.

 

Make a fresh flash. First thing to do after flash is :

 

telnet to box and use passwd to set password. (before any restore)

 

exit and test . You will see that it's back ok.

 

Now set back you're settings

[MiLo]

Before anything else, stop exposing your box to the internet. Don't forward ports to it from your router/modem.

[antoine3_dupres]

You were all right!!!

After having enable root password and manage to put a password

I have checked the syslog in /var/log/messages and I saw:

 

Jan 29 08:48:24 vuduo authpriv.warn login[521]: invalid password for 'root'  on

'/dev/pts/2' from '78.188.196.69:39180'

 

Jan 29 08:38:23 vuduo authpriv.warn login[477]: invalid password for 'root'  on

'/dev/pts/2' from '117.218.161.86:10553'

 

Jan 29 08:35:26 vuduo authpriv.warn login[435]: invalid password for 'root'  on

'/dev/pts/2' from '1.34.123.62:51869'

 

All these addresses are from India, Turkey.....

 

Then I have isolated the box from internet.

 

A question I have: When openPli 4 is installed does the user root has no password by default? (i.e. entry in /etc/passwd like "root::0:0:root:/home/root:/bin/sh" )

This issue started end of last year after I installed OpenPli 4.0  (before that date I had a openPli 2). 

 

Thanks for the help.

 

PS: My telnet is now working perfectly.

[WanWizard]

You should never expose anything to the internet. You don't do it with your PC or NAS, you should not do it with an STB either. With or without password, it is not secure.

[christophecvr]

You were all right!!!

After having enable root password and manage to put a password

I have checked the syslog in /var/log/messages and I saw:

 

Jan 29 08:48:24 vuduo authpriv.warn login[521]: invalid password for 'root'  on

'/dev/pts/2' from '78.188.196.69:39180'

 

Jan 29 08:38:23 vuduo authpriv.warn login[477]: invalid password for 'root'  on

'/dev/pts/2' from '117.218.161.86:10553'

 

Jan 29 08:35:26 vuduo authpriv.warn login[435]: invalid password for 'root'  on

'/dev/pts/2' from '1.34.123.62:51869'

 

All these addresses are from India, Turkey.....

 

Then I have isolated the box from internet.

 

A question I have: When openPli 4 is installed does the user root has no password by default? (i.e. entry in /etc/passwd like "root::0:0:root:/home/root:/bin/sh" )

This issue started end of last year after I installed OpenPli 4.0  (before that date I had a openPli 2). 

 

Thanks for the help.

 

PS: My telnet is now working perfectly.

That would be of no use, As they will have to publish this password to public.

 

Like WanWizard said Never expose you're stb directly to the internet , always use router with firewall and nat.

 

If you self wan't to acces you're box from abroad. use ssh . Do not use telnet and or ftp.

[MiLo]

You can safely forward port 22 (ssh) from the box to the outside.

All other ports (in particular telnet, http and ftp) are totally insecure. They're intended for in-home sharing only, NEVER forward them to the outside world, with or without passwords.

[antoine3_dupres]

what do you mean with "That would be of no use, As they will have to publish this password to public."?

my question was "When openPli 4 is installed does the user root has no password by default? (i.e. entry in /etc/passwd like "root::0:0:root:/home/root:/bin/sh" )".

I was asking it because just typing  "passwd" after install is not good enough, it changes the password but does not add the x in /etc/passwd, so root user can still login with nopassword

 

Thanks again.

[christophecvr]

what do you mean with "That would be of no use, As they will have to publish this password to public."?

my question was "When openPli 4 is installed does the user root has no password by default? (i.e. entry in /etc/passwd like "root::0:0:root:/home/root:/bin/sh" )".

I was asking it because just typing  "passwd" after install is not good enough, it changes the password but does not add the x in /etc/passwd, so root user can still login with nopassword

 

Thanks again.

negatif it does add the x after you used passwd. Seems that You personnally modifie something or was hacked again. Again like Milo and WanWizard said do not open you're box to the world wide web.

Use router and firewall.

[antoine3_dupres]

I have tried again:

  - removed the x from /etc/passwd

  - change password

 

the x had not been added in /etc/passwd!!!

 

The box is 100% isolated now, so it is not hacked again.

 

Could the exe "-rwsr-xr-x    1 root     root         58192 Sep  7 15:35 /usr/bin/passwd.shadow" had been changed?

 

Very weird.

[christophecvr]

To openpli there is nothing wrong. Just reflash and see that you're box is behind router and firewall before !!! That's all You can do You've been hacked . It requires an expert to solve this out .

[antoine3_dupres]

I was not complaining about OpenPli!

Simply asking what is the behaviour of the command passwd. Have you try it on your box? (or like me you assume the x shall be set by passwd command).

[christophecvr]

I was not complaining about OpenPli!

Simply asking what is the behaviour of the command passwd. Have you try it on your box? (or like me you assume the x shall be set by passwd command).

I not only assume the x is set it is set by using passwd. Reflash and you're problem is solved.

[antoine3_dupres]

Sorry to insist but have you try yes or no?

Sorry again.

 

I also found this post http://openpli.org/f...ot-doesnt-work/ that describes exactly the problem I had!!!!!

Edited by antoine3_dupres, 29 January 2014 - 13:51.

[WanWizard]

I don't have any 'x' in /etc/passwd, and I have no password problems whatsoever. So what is exactly the issue here?

[antoine3_dupres]

You mean your entry in /etc/passwd is  "root::0:0:root:/home/root:/bin/sh"  ?

Then when you telnet to the box no password is asked for the root user.