[SOLVED] Proxmox Updates Failing

[infinityM]

the file is marked as immutable - see `man lsattr`, `man chattr`.

Unless you know how that happened I would suggest to take a good and close look at the system (and especially at the user accounts in /etc/passwd) - this is something I've seen happening on hacked systems (though it can also be a cautios local admin, who wishes to prevent such things)

In any case I guess this explains the problems of `usermod` initially causing the problems

I hope this helps!

Ok i'm a bit lost still with how to resolve it?

 

[Stoiko Ivanov]

removing the immutable flag is straight-forward:
`chattr -i /etc/passwd`

answering the question of how it got there in the first place is the difficult part - and with that I cannot help you ...

 

[infinityM]

the file is marked as immutable - see `man lsattr`, `man chattr`.

Unless you know how that happened I would suggest to take a good and close look at the system (and especially at the user accounts in /etc/passwd) - this is something I've seen happening on hacked systems (though it can also be a cautios local admin, who wishes to prevent such things)

In any case I guess this explains the problems of `usermod` initially causing the problems

I hope this helps!

#FacePalm

Thank you bud, You've been a star!!!

 

[infinityM]

Sorry for re-opening the thread. Thought i'd bring some closure...
Turns out this server was hacked. They gained access through ILO and infected the server.

They then setup a cronjob to run every minute to check for a directory /usr/bin/yamd if it did not exist, it unzipped /usr/bin/c to that directory and ran it.

It's first job was to then change the /etc/passwd and /etc/shadow to immutable and then started a minerbot up.
Took quite a while to find it but yeah. Finally got it!!!

Thanks everyone!