Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This is frustrating. I am often able to login with a root password. Then I cannot login again. However, I am still logged in. Hence my password must be correct.

I changed the root password with passwd. It works again. Then sometimes latter this happens again.

It's as if the root password changes all the time automatically. Did someone hack my server?

share|improve this question
1  
Just a short note: a password change does not close the existing sessions. The fact you're still logged in does not mean that the password at any given time is the same that you have used to log in. –  Leonid Jan 4 '13 at 5:21
    
It's not that the password keeps changing. It seems that server reject all root login for a few hours and stuff. –  Jim Thio Sep 27 '13 at 12:03
    
/var/messages are indeed full with so many failed login attempt. –  Jim Thio Sep 27 '13 at 12:03

1 Answer 1

up vote 1 down vote accepted

Assuming someone is playing around with your box or some kind of practical joke, and they did not cover their track.

Check login history

Via Command Line

w
last

Via Log Files

/var/log/auth.log (debian/ubuntu)
/var/log/secure (RedHat/CentOS/Fedora?)

Other Possibilities

  1. Your box is a virtual machine and some how keep getting roll back to previous state(snapshot).
  2. Many VPS actually reset your root password. You have to use the vendor/hosting web interface to change the root password. Otherwise it will just keep changing back to the previous one.
share|improve this answer
    
how do I know my server's IP? Maybe I am logged in to a different machine –  Jim Thio Jan 4 '13 at 4:12
    
Login in as root, type command ifconfig. If you are using a windows machine, go to website whatismyip.com –  John Siu Jan 4 '13 at 4:19
    
@JimThio I have the following command readily available; it will print the external IP address that you are using to make outbound connections, thus taking into account NAT etc. wget -qO- http://ipecho.net/plain That's just one service to obtain one's IP address; there are numerous others. -q means use quiet mode, and -O- means print the content of the response to - (standard output) rather than saving it to a file. –  Michael Kjörling Jan 4 '13 at 12:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.