At 10:28 AM -0700 8/18/06, Mike McMullen wrote: >> >> It is on the order of random-typewriter monkeys producing Hamlet that this >> particular issue could happen from a bad RPM -- but it is *quite* likely >> that it could happen if your system were hacked and someone clumbsily >> installed a trojaned sshd. >> >> What happens if you run "rpm -V openssh"? > >When I run that I get no output. It just returns to the prompt. This is >the same on a system that works and a system that doesnt. > > >> And, uh, I'd also run chkrootkit. > >I've run chkrootkit on 3 systems. All report "nothing found" or "not >detected." > >netstat -pant only shows connections to port 22 from legit places. You seem to have two versions of ssh installed on the affected boxes. The debian one won't be reported by rpm. Maybe those boxes have been cracked, or maybe the debian ssh has always been there but either previously worked so it wasn't noticed or the update changed which one got loaded. Perhaps something was moved and there is a .rpmnew file that would have handled that. ____________________________________________________________________ TonyN.:' <mailto:tonynelson@xxxxxxxxxxxxxxxxx> ' <http://www.georgeanelson.com/>
