password problem

[tonykn2001]

Hi,
I am not looking for advice on how to reset root password; I am looking for knowledge as to whether or not DirectAdmin in some way interferes with the password process.

I enclose below details of the problem and do not want to waste people's time, I have posted this to LinuxQuestions already. The issue I need help with here is just what effect, if any, does DA have on the password system.
Many thanks,

Tony

For info only: .......

The problem.
I have a remote server FC3 protected with APF firewall and bastille.
Firewall set to block IP addresses after 20 failed access attempts and allow access from my fixed IP address.
Remote root login disallowed, su to root required.
Bastille set up to prevent console root access.

All worked well until I changed broadband provider and hence had a new fixed IP address,this combined with me getting muddled with passwords APF jumped and I am now locked out.

Went away, did some reading, sent following mail to the hosting company.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++
Please boot system from FC3 disc 1
Enter "linux rescue" as command
Choose 'english' for language
Choose UK for keyboard
Do not setup network

at prompt type chroot /mnt/sysimage

Then:

type nano /etc/shadow. (I am presuming the pw is in the shadow file)

In the /etc/shadow file please enter the password string below as the encrypted password (between the two colons to replace existing entry) for root.

root:this is the password:13181:0:99999:7:::
('this is the password' was in fact a copy of password obtained from my FC3 local test machine, changed for posting to this board)

Type ctrl-x to exit, Y to agree to changes and enter to save.

If encryption is machine dependent then

Copy the password element of the entry for admin in the shadow file into the root entry.

Finally with reference to the APF firewall:

Type nano /etc/apf/allow_hosts.rules

please place my home IP address 12.234.45.57 (changed for posting)

in the file, remove existing contents and save as above.

Please empty /etc/apf/deny_hosts.rules

Then reboot and hopefully this will get me back in.

+++++++++++++++++++++++++++++++++

The response I have had is :-

I tackled this last night/this morning. I managed to clear the root password, then get access to single-user mode to change it. That all went well, however as soon as I boot into normal mode, the password appears to be changed - I can't then get back in to single user mode again. I'm wondering if either the firewall or DA is doing some sort of password sync that's designed to stop other people from changing the password. Have you got any ideas?

++++++++++++++++++++++++++++++++++

 

[nobaloney]

DA is not doing anything to your root password; it doesn't care about it at all.

Your sshd_config file may be disallowing root shell access through ssh, but nothing should be disallowing it from the console.

It sounds as if you've been hacked.

Jeff

 

[tonykn2001]

No not hacked apparently. I think the chroot step was missed out.
I now have access to the system after the firewall settings were set correctly and the password system seems to be working fine now.
Thanks for your response,
Tony