Re: [webmin-l] Crackers_Child hack now mysql login on webminaproblem

[Obantec S. <su...@ob...>]

----- Original Message ----- 
From: "Jamie Cameron" <jca...@we...>
To: "Webmin users list" <web...@li...>
Sent: Monday, August 21, 2006 6:55 PM
Subject: Re: [webmin-l] Crackers_Child hack now mysql login on
webminaproblem


> On 21/Aug/2006 10:05 Obantec Support wrote ..
> >
> > ----- Original Message ----- 
> > From: "Jamie Cameron" <jca...@we...>
> > To: "Webmin users list" <web...@li...>
> > Sent: Monday, August 21, 2006 4:23 PM
> > Subject: Re: [webmin-l] Crackers_Child hack now mysql login on webmin
> > aproblem
> >
> >
> > > On 21/Aug/2006 07:45 Obantec Support wrote ..
> > > > Hi
> > > >
> > > > following an attack on my server i lost webmin and usermin as the
attack
> > > > changed all index files to display Crackers_Child text.
> > > >
> > > > we have advised all users on how to restore their sites but when i
> > go to
> > > > webmin/mysql i get the user/password box and cannot login to the
mysql
> > > > server.
> > > >
> > > > /etc/my.cnf has
> > > > user=mysql
> > > >
> > > > so i assume user for mysql is mysql.
> > > >
> > > > i tried changing the password for mysql but sill cannot get webmin
> > to
> > show
> > > > the databases.
> > >
> > > Can you login OK from the command line using the 'mysql' program? If
> > so,
> > Webmin
> > > should be able to connect using the same username and password, which
> > you
> > can set
> > > on the Module Config page.
> > >
> > > If this still doesn't help, try changing the option on the module
config
> > page for
> > > using DBI to No.
> > >
> > >  - Jamie
> > >
> >
> -------------------------------------------------------------------------
> > > Using Tomcat but need to do more? Need to support web services,
security?
> > > Get stuff done quickly with pre-integrated technology to make your job
> > easier
> > > Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
> > >
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> > > -
> > > Forwarded by the Webmin mailing list at
> > web...@li...
> > > To remove yourself from this list, go to
> > > http://lists.sourceforge.net/lists/listinfo/webadmin-list
> > >
> > >
> > >
> > > -- 
> > > No virus found in this incoming message.
> > > Checked by AVG Anti-Virus.
> > > Version: 7.1.405 / Virus Database: 268.11.3/423 - Release Date:
18/08/2006
> > >
> > >
> > Hi Jamie
> >
> > when i try to login (i am root) i get
> >
> > ERROR 1045: Access denied for user: 'root@localhost' (Using password:
NO)
> >
> > i can su mysql and get in with mysql but i don't know the systax
> >
> > setting the user and password via webmin/mysql config fails.
>
> So you can login to mysql as the user 'mysql' ?
> Or do you mean you can just switch to the Unix user 'mysql' with the su
command?
>
>  - Jamie
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> -
> Forwarded by the Webmin mailing list at
web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>
>
>
Hi Jamie

from SSH as root i can get into mysql with

mysql -u mysql -p
and enter no password when challenged just hit carriage return.

if i use mysql -u root -p and blank password i get 1045 error (i have tried
all common passwords i use but still no joy).

in webmin i do same mysql as user and no password but this means i can see
database but do not have enough permission to do anything.

any idea what my next step might be?

Mark