[ale] passwd for root not working

[Atlanta Geek]

A machine that I was not in charge of seems to have been broken into
over the weekend.
I am trying to help the sysadmin.  However there seems to be some
weird things going on when I try to lock the system down.

1. found that /var/log/secure was a directory and not a file.
2. when as root I type passwd I found that passwd command was missing.
3. copied passwd from another server.  When trying to set password we
get the following:

[root at localhost etc]# passwd
Changing password for user root.
New UNIX password:
Retype new UNIX password:
passwd: Authentication token manipulation error


Here are some details about shadow and passwd files

[root at localhost etc]# lsattr /etc/passwd
----i-------- /etc/passwd
[root at localhost etc]# ls -altr passwd
-rw-r--r-- 1 root root 1616 Feb 28  2009 passwd
[root at localhost etc]# ls -altr shadow
-r-------- 1 root root 954 Oct  1 08:42 shadow
[root at localhost etc]# lsattr passwd
----i-------- passwd
[root at localhost etc]# lsattr shadow
----i-------- shadow



Any assistance would be appreciated.

-- 
http://www.atlantageek.com