FC4 and ssh passphrases not working

[Matthew Miller]

On Fri, Aug 18, 2006 at 11:09:55AM -0700, Mike McMullen wrote:
> >>I've run chkrootkit on 3 systems. All report "nothing found" or "not 
> >>detected."

What about the rpm -V for openssh-server?

> >>netstat -pant only shows connections to port 22 from legit places.
> >Hmmm. How many other admins does this machine have?
> It's a small shop. Only me.

This really tends toward the "hacked" theory. Either no one is using the
connection illictly now, or it's hidden by a rootkit.

But let's try to eliminate other possibilities. The "netstat -pant" (as
root) should show you the process ids of the legit ssh sessions. Then, use
ps (or look in proc... whatever) and see what process is the parent of that
one. It should be /usr/bin/sshd.

If it's *not* /usr/bin/sshd, that's peculiar. But if it *is*, and "rpm -V
openssh-server" claims that the sshd is unmodifed, and yet it still claims
to be the debian binary, that's even *more* peculiar.

-- 
Matthew Miller           mattdm at mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>