Hey, what the ****... (resolved)

[dexen deVries]

clockworkanomaly

p3ngu!n

As for your problem, maam, have you tried recreating the user once more?

Yeeeeah, we just tried that out now. And it's really funny (in a severely not funny kind of way) that it kept kicking both me (on SSH) and a tech support guy AT the box back to the prompt when we tried it.

Methinks that root kit is still there. In which case we're pretty much f*cked, but I'd like to see if anyone else has an explanation for this.

edit because somebody asked: It's running FreeBSD.

I'd say, try creating account by hand. Like, remove it from passwd, shadow & group, then Copy-And-Paste another entry in passwd and shadow, and change UID and login by hand. Then ensure, that owners UIDs match on htdocs and subdirs.

EDIT: BTW, ftp is strange way to work with remote files. People tent to use scp rather, AFAIK.

[Bill Giggles]

Nikashera

The only thing I could think is that a few files in apache got messed up when it was converted to backup, maybe because there was a drastic change in files?
(I don't run Apache nor FTP servers so I can't help much on there)

Yeah, and we lost a few users altogether when the rollback occurred, not to mention a bunch of passwords suddenly being out of sync. I still have to wonder if somebody is still using a backdoor, though, because it is just too weird to suddenly lose control of an admin account like that; it'd been working fine since we restored it.

Gracias for the link, sir. I'll look into that for the future.

dexen_of_wroclaw

BTW, ftp is strange way to work with remote files. People tent to use scp rather, AFAIK.

Well, not if I'm just trying to upload a quick folder or two into my web directory, it isn't (which is just how this problem was brought to my attention). Let's not overcomplicate things, here. xd

[Synapt]

Offtopic:

For the people in this forum/thread spamming and not being of any use by replying with an ontopic helpful reply, Please Read the C&T Forum Stickies

C&T Rules (Read me or be banned!)
C&T General FAQ (Read me, or be banned!)

Ontopic: I am sorry that I have no ontopic helpful reply that I can make at this time, but the offtopic notification had to be made.

I will refresh every so often to see if there is anything I can help further with.

[giermule]

clockworkanomaly

Nikashera

The only thing I could think is that a few files in apache got messed up when it was converted to backup, maybe because there was a drastic change in files?
(I don't run Apache nor FTP servers so I can't help much on there)

Yeah, and we lost a few users altogether when the rollback occurred, not to mention a bunch of passwords suddenly being out of sync. I still have to wonder if somebody is still using a backdoor, though, because it is just too weird to suddenly lose control of an admin account like that; it'd been working fine since we restored it.

Gracias for the link, sir. I'll look into that for the future.

If there is something still there it will be hard to detect, since there aren't many virus/trojan scanners for linux simply because they have a hard time surviving on a system that changes with every update.
There was a few things that I knew that could locate what belongs and doens't belong on your system, and show you what needs to be changed to work exactly.. but I forgot the commands and names sweatdrop
Maybe you could compare it to another server that is set up just fine?

[Bill Giggles]

FIX'D. *triumphant pose*

So, somehow, something in the UID got ******** up when we did that rollback in December so that the permissions for the admin user was not set to "0100" as it should have been, but rather with just read permissions or something equally retarded (which explains why it was freaking out when we tried to move/delete/create directories). So, all's well in admin land again now that that's been reset and all the passwords have been resync'd.

Hey, much thanks to all that offered help. You guys rock the casbah. heart

[giermule]

Your welcome ^^

[p3ngu!n]

bahamuto78234

WOO TECHNOLOGY!!!!

I'm gonna politely tell you to piss off.

Sir, please don't post if you don't have anything to contribute.

clockwork, have you tried asking your host?

[Bill Giggles]

p3ngu!n

clockwork, have you tried asking your host?

Issue's already been resolved, tiger. But thanks.