Root password changing by itself

[Schiz0]

On Mon, May 19, 2008 at 3:49 PM, Vijay Krishnan
<vijay.stanford at gmail.com> wrote:
> Hi all,
>
>    I have Ubuntu 7.10 installed on my machines. I strangely find
> that I am often unable to login to the machine with my regular
> root password using ssh. Fortunately I have physical access to the machine,
> which allows me to change the password back. Any idea what could be
> the reason? Is it necessarily evidence of my machine being hacked
> into, or could it also have something to do with my messing around
> with ssh keys etc.? What should I do to protect against both
> possibilities. In other words if it is a security breach, how do I
> plug it and prevent the "hacker" from having continued access.
>    If the password change is a result of something else, what are
> the possibilities I should address.
>
>

Most of the time, root login is disabled through SSH (as it is a
security hole). Try logging in as a normal user, then use "sudo" or
"su" to switch to root using your normal password.

Also, check your /var/log/ for ssh logs, and user auth logs to see
exactly what's going on.