Koozali.org: home of the SME Server

Bootup halts at -> Starting SMB: OK

SHadowX

Bootup halts at -> Starting SMB: OK
« on: November 23, 2004, 06:47:40 AM »
Hi Guys,

Well i have been poking around trying to find out what may be cauing this issue and have not been able to. For some reason our machine halts just after starting SMB then goes no further.

Any ideas would be appreciated as I have run out of things to try (short of reloading)
I even tried upgrading to a later version of SME.
Its now running 5.6

Reards
Andrew

Offline MSmith

  • *
  • 675
  • +0/-0
Get your data, then reformat/reinstall
« Reply #1 on: November 23, 2004, 04:14:50 PM »
If you're just now getting around to upgrading to 5.6, and your machine running 5.1.2 or 5.5 has been exposed directly to the Internet, your machine is most likely compromised.  Best procedure:  use a Knoppix CD to save your data to a networked share or a second hard drive, then reformat & reinstall with 6.0.1 (or wait for the first Lycoris release).

Alternatively, it may be that your hard drive is corrupt, in which case use that Knoppix CD again to do a fsck.

But I'd bet on your machine's having been r00ted.
...

SHadowX

Bootup halts at -> Starting SMB: OK
« Reply #2 on: November 23, 2004, 07:27:53 PM »
Thanks for the sugestions, I have checked and there seems to be no sign of a r00tkit. they were already behinf a firewall however i am not yer ruling this out. All poert were blocked other than the required ports.

I think a reinstall is in order...

Andrew

Offline Reinhold

  • *
  • 517
  • +0/-0
    • http://127.0.0.1
Bootup halts at -> Starting SMB: OK
« Reply #3 on: November 24, 2004, 09:14:07 AM »
ShadowX,

The SME version you have been using can be r00ted :-(
Stopping at SMB does indeed seem stange...

If and when you reinstall definitely go for 6.01
and install the newest security fixes which you find at various places mentioned in this forum
one would be http://sme.swerts-knudsen.dk/

I would be interested to do some inspection before a new install
 ... it's always helpful to see who/what (tried to get/) "got you".
Rkhunter can be found at http://mirror.contribs.org/smeserver/contribs/dthomas/smeserver/6.x/Contrib/rkhunter/


Regards
Reinhold
............