ssh2

[Bill Davidsen]

roland wrote:
> On Sat, 20 Sep 2008 20:48:47 +0200, Bill Davidsen <davidsen at tmr.com> wrote:
> 
>> The worrying thing is that since the sshd now asks for ssh2 protocol 
>> only, there is a new sshd operating, one you didn't install, and one 
>> which may be copying keystroke data (login names and passwords) to 
>> some unauthorized other site. I can't say that's happening, but this 
>> has all of the characteristics of that. It could also be caused by an 
>> upgrade of sshd, although I read your posts to say that only you could 
>> do that.
>>
>> It would be useful to use 'ps' to see which sshd is running, and to do 
>> an 'ls -l' and md5sum on the executable and post the values here. Also 
>> a telnet to the ssh port usually gives the protocol and sshd version, 
>> although that can be faked. Post that if you wish
> 
> You will find it in  annex
> 
> Thanks again for your time

 From the attachment:

 > telnet localhost 22
 > Trying 127.0.0.1...
 > Connected to localhost.
 > Escape character is '^]'.
 > SSH-2.0-SSH-1.99-OpenSSH_3.5p1

That is a *very* old version of OpenSSH, nothing you got from Fedora, I believe. 
I think it's something which the hacker installed, and a hacked sshd would be 
the perfect place to capture login and password information.

 > service sshd status
 > As you can see it doesn't give sshd but this crazy characters, in both cases
 >
 > 1628 ?        S      0:02 ?a?@°Ó?@?
 > 22871 ?        S      0:00 ?a?@°Ó?@?

Just how old a Fedora do you have? This doesn't look at all as I would expect. 
You might do "ls -lc /bin/ps" and see if that was recently replaced as well. 
However:

 > ls -l /usr/sbin/sshd
 > -rwxr-xr-x    1 root     root      3963123 sep 16 00:03 /usr/sbin/sshd

This looks as if the sshd was replaced a few days ago, shortly before your first 
message to the list. That makes it even more likely that passwords are being 
captured, perhaps even entire connect sessions.

It looks as if the machine has been totally penetrated, and of course if you 
don't use different account names and passwords for other machines they have as 
well.

-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot