Sshd_config/

maas187 · 04-20-2009, 02:09 PM

Hi to all,

I have a trixbox machine which is really CentOS , for some reason my sshd_config becare read only ? and i cant edit it . and i believe by default root can edit this file ?

just want to know if my system has been hijacked ? or is this normal ?

thank you

kentyler · 04-20-2009, 02:10 PM

run lsattr on the file and see if it's attributes are set, if so the machine may be owned.

maas187 · 04-20-2009, 02:20 PM

Quote:

Originally Posted by kentyler

run lsattr on the file and see if it's attributes are set, if so the machine may be owned.

well just want to know if this is normal behavior from sshd_config ?

thanks

jschiwal · 04-20-2009, 02:23 PM

You can run "sudo rpm -qV openssh" to check if the permissions have changed.

Also take selinux into consideration.

maas187 · 04-20-2009, 02:42 PM

Thank you guys.

anomie · 04-21-2009, 06:03 PM

No, that is not normal (unless you or another sysadmin removed the write permission). What does it show when you do a long listing:

# ls -l /etc/ssh/sshd_config

?

And what does this command show?

# mount

(A damaged filesystem can cause / to mount ro.)

maas187 · 04-21-2009, 11:07 PM

Quote:

Originally Posted by anomie

No, that is not normal (unless you or another sysadmin removed the write permission). What does it show when you do a long listing:

# ls -l /etc/ssh/sshd_config

?

And what does this command show?

# mount

(A damaged filesystem can cause / to mount ro.)

I shows the permission 600. or 400 i think .

iam not infront of the machine now .

billymayday · 04-21-2009, 11:09 PM

It should be 600 (ie rw for root only)