roland wrote:
On Sat, 20 Sep 2008 20:48:47 +0200, Bill Davidsen davidsen@tmr.com wrote:
The worrying thing is that since the sshd now asks for ssh2 protocol only, there is a new sshd operating, one you didn't install, and one which may be copying keystroke data (login names and passwords) to some unauthorized other site. I can't say that's happening, but this has all of the characteristics of that. It could also be caused by an upgrade of sshd, although I read your posts to say that only you could do that.
It would be useful to use 'ps' to see which sshd is running, and to do an 'ls -l' and md5sum on the executable and post the values here. Also a telnet to the ssh port usually gives the protocol and sshd version, although that can be faked. Post that if you wish
You will find it in annex
Thanks again for your time
From the attachment:
telnet localhost 22 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. SSH-2.0-SSH-1.99-OpenSSH_3.5p1
That is a *very* old version of OpenSSH, nothing you got from Fedora, I believe. I think it's something which the hacker installed, and a hacked sshd would be the perfect place to capture login and password information.
service sshd status As you can see it doesn't give sshd but this crazy characters, in both cases
1628 ? S 0:02 ?a?@°Ó?@? 22871 ? S 0:00 ?a?@°Ó?@?
Just how old a Fedora do you have? This doesn't look at all as I would expect. You might do "ls -lc /bin/ps" and see if that was recently replaced as well. However:
ls -l /usr/sbin/sshd -rwxr-xr-x 1 root root 3963123 sep 16 00:03 /usr/sbin/sshd
This looks as if the sshd was replaced a few days ago, shortly before your first message to the list. That makes it even more likely that passwords are being captured, perhaps even entire connect sessions.
It looks as if the machine has been totally penetrated, and of course if you don't use different account names and passwords for other machines they have as well.