Have I been hacked? Shadow file deleted

[Scot L. Harris]

On Fri, 2005-09-09 at 10:06, Jose Luis Hime wrote:
> chkrootkit and rkhunter do not report any problem.
> 
> I am still with this issue, any hints?
> 

How many people have access to root?  Assume you have changed the root
password as well as checked the /etc/passwd and /etc/shadow files for
any odd entries.

What permissions does the /etc/shadow file have?

You should also check all cron jobs to see if someone set something up
there.

Last resort is to do a complete bare metal install again and keep root
password to yourself.