Hi all, I have 2 woody boxes, the first one configured as an adsl firewall (a simple iptable-deny-everything stuff, no local service running, only LAN originated traffic allowed). On the second box since yesterday, my path when logging as root became "/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games", like the one for an ordinary user. Same behavior if I "su -" from an ordinary account, but the good old root path is back if I just type "su" (without the hyphen).
Where does Debian define the root login path? I checked /etc/login.defs (and of course /root/.bashrc), but nothing changed / my other woody box. Btw why is the default user path defined both in /etc/login.defs and /etc/profile? Is this strange behavior a known sign of intrusion? I got nothing unusual in both machines's logs... I also tried chkrootkit, nothing found. Of course I might also have done something wrong, but can't remember what. Does anyone have a hint on what's going on? Thanks, David.
