Can't connect via ftp (GID problem?)

I have a redhat linux box and am using wu-ftp, since it's what was installed on the machine. About a week ago, I noticed that I could no longer ftp into it. I run the ftp command from another machine and give my username and password like always. After that, it just sits there. Looking at the syslog file, the only line that jumps out at me is


Apr 16 12:41:31 beast pam_timestamp_check: pam_timestamp: `/var/' owner GID != 0

Apparently, the group id of the person logging in has to be zero. However, I haven't changed any of the user's permissions and I'm the only one that has root access on this account. In any event, if anybody can help me out on this one I'd be thankful.

No, it says that /var needs to be owned by gid 0 (=root). Have a look if it is. If you did not change it, did not install new software since then, did not upgrade anything and did not make any other changes, maybe you have been hacked.

It could also be the result of a "chown user.group .*" inside a subdirectory of /var when changing ownership of hidden files. The ".*" expands to ".." too.

because I can't run ls -l on my root directory. It just hangs. So I can't even check the permissions on /var. I've never seen something like this before. I did a quick look (thinking about your hacking theory) to make sure somebody didn't drop an "ls -l" trojan in my root directory. The funny thing is, the guy that I took over for was basically forced out. Anyway, lemme do the windows thing and reboot and see if this clears things up.

Good, because I'm swamped with work right now and I didn't need this headache!