Re: ssh2

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



roland wrote:
On Tue, 16 Sep 2008 22:19:51 +0200, Nifty Fedora Mitch <niftyfedora@xxxxxxxxxxxx> wrote:

On Tue, Sep 16, 2008 at 11:30:14AM +0200, roland wrote:

I am using a terminalemulator Anita to login to a server, who validates
the ssh connection with 3DES Cipher.

Now this server is hacked, somebody entered with the root user.
Suddenly I have ssh2

So root has been compromized?
How do you know?

I saw the login in /var/log/messages
And suddenly I had a dir ssh2 in /root which is not normal I think. One only get it when generating a rsa or dsa key, isn't it?

So now I get the following message, when trying to login:
dsa_verify failed for server_host_key

Again: that is because the host key on the server has changed, probably because a new sshd has been installed. The fact that the old keys were not used means either an incompetent hacker or just that you are connected to the wrong machine. It's a warning from your terminal program, so you don't type a password which can be stolen.

I see the directory .ssh2 in the /root directory, but not in any $HOME dir

How can I stop ssh2 verifying?

Or is there something else I can do?

Was Anita compromised?
No, because I have the same problem here from out of Greece

Was Anita updated?
No, why should I, it always worked, and this version of mine works with all other clients

Was Anita changed?
No, same answer

I have to say, somerthing akward is going on there, because all workstations failed to connect Anita, except one.

Was the author of Anita contacted?
No
Anita for windows?
yes
Anita for the web?

Is Anita connecting to sshd on the linux host in the same way that Putty does?

How can I tell? ssh is not a thing i could say I master.

Can you login and 'su -' to root......
yes

I changed the password and know this guy is trying to login again, but fails. Apperently he was not ready, but maybe changed the key.

If so you can look at the logs?
Do the logs make sense?
Yes, like I sed above.


dsa_verify failed for server_host_key tells me that a key was changed
not that the host was compromized... If you update the key the
old key needs to be removed....  F

can you tell me what the best way is to generate those keys, because my last experience with this failed.

Is it possible that the night shift upgraded to ssh2 or added it?
I am the only one.

Is it possible that the night shift added (incorrectly) their own key?
-- php, perl, java, etc...
like above

As others indicated -- IF it has been HACKED
SHUT IT DOWN, pull the plug.  The legal liability
of keeping a hacked system up and running
is large.
As I sed, I will do this when I'm back from holidays.

Are the keys in the .ssh2 dir telling you anything...
??.

If .ssh2 does not contain your keys -- rename/remove it.

Do the keys in the .ssh2 dir belong to anyone... someone you can call.
Sometimes the comments are informative and id a host or person.

It might be that someone knows what was done in your absence.
Who else has pass words or access to the systems?
those who could know about the root password don't know anything about linux or others.


How does ssh checks keys. I am asking this because anita fails before she knows who is login in. So if she takes the login of windows which is mine, she would login or check in $HOME/.ssh. And in $HOME there is no .ssh2, so probably there will be checked in /etc/ssh/ for dsa and rsa keys. So if I remove those keys, would that change it?

I would not expect the .ssh2 directory to be generated on login from outside, although ssh would check for an "authorized keys" file. In checking a number of accounts I know are used but not for outgoing ssh, I find no such directories on any account. Therefore I'm reasonably certain that this was created for an outgoing ssh connection.

The reason you get a host key warning is that the host keys in /etc/ssh have been changed. It might be that you have an unauthorized copy of sshd running which is keylogging every password used to login. This is why people are telling you to shut the machine down, it may well be doing more damage every day.

What are the dates on the files in /etc/ssh*? In the .ssh2 directory? Is your client going to suffer any damages by having all of their data and passwords revealed?

Thanks again
roland










--
Bill Davidsen <davidsen@xxxxxxx>
  "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux