Messages in this thread | | | Date | Sun, 13 Dec 1998 12:22:23 -0800 | From | Mike Orr <> | Subject | Re: HELP!! "Unable to open initial console" |
| |
On Sat, Dec 12, 1998 at 12:16:33PM +1100, Aaron Lehmann wrote:
> The moment I got home, I saw on the screen a seemingly normal boot > scroll. It was stopped after the line "VFS: mounted root fs read-only" > with "Unable to open initial console". Same thing happens under 2.0.35 > and 2.0.36. I would try a rescue disk but my floppy drive does not > seem to be working.
I get the "Unable to open initial console" error when the /dev file corresponding to the console is missing. Usually it means I specified the wrong root partition on the LILO command line. (One wishes the error message were more precise -- it could at least say why it can't open it: "/dev/tty0 not found", "/dev/console not found", "/dev directory missing".) This would be consistent with your suspicion that files were unexpectedly deleted. Whether that points to a cracker, disk failure, or a very buggy program running as root I cannot say. You didn't mention which kernel you were running at the time -- was it a 2.1.something?
> basically all the services (telent, smtp, pop, ftp) would disconnect > you in a few miliseconds.
Does your inetd use the tcpd wrapper around these services? Tcpd disconnects you without error message if you fail its security checks. Missing files could have caused false failures. If inetd can't find the executable at all, perhaps it does the same thing (I haven't tried this.)
> My questions are: > 1) What does that message mean? > 2) How can I fix it?
You need to boot Linux somehow and examine the disk. Do you have a second hard drive you can plug in and install a minimal Linux on? Or can you borrow a working floppy drive from somebody? Then mount your partitions readonly and back up your data. Then use your favorite fdisk program and fsck to determine whether the system is salvageable or you want to reformat/reinstall or send the disk for warranty exchange.
> 3) How did the daemon wackiness evolve into this? Did I get hacked? It > seems as if the hacker was able to screw up the hardware somehow!!
I'll leave others to explain how to exhaustively check for signs of hackerdom. If you seriously expect you've been cracked, I'd reinstall Linux anyway to close any loopholes you might overlook during your inspection. Or at least change everybody's password and delete any users in /etc/{passwd,shadow} you don't recognize. (But don't delete system users like "news" that came with the Linux distribution. Instead, change the password to "x" or "*" so no-one can log in.) Turn off unnecessary services. Consider switching to ssh instead of telnet.
-- -Mike Orr, mso@jimpick.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |