On a couple of CentOS 5 servers sshd seems to have become 'unwrapped' - previously I was using TCP wrappers and hosts.allow/hosts.deny to control access, but these are now not being used. If I execute
$ldd /usr/sbin/sshd | grep libwrap
$
it outputs nothing, whereas on servers where TCP wrappers are still working I see
libwrap.so.0 => /lib64/libwrap.so.0 (0x00002b2fbcb81000)
Does anyone know what might cause this, or how it could be rectified?
Updated As requested:
$ rpm -qV openssh-server
S.5....T c /etc/pam.d/sshd
S.?....T c /etc/ssh/sshd_config
S.5..... /usr/sbin/sshd
Output of ldd /usr/sbin/sshd is:
libpam.so.0 => /lib64/libpam.so.0 (0x00002af906b89000)
libcrypto.so.6 => /lib64/libcrypto.so.6 (0x00002af906d94000)
libdl.so.2 => /lib64/libdl.so.2 (0x00002af9070e5000)
libutil.so.1 => /lib64/libutil.so.1 (0x00002af9072ea000)
libz.so.1 => /lib64/libz.so.1 (0x00002af9074ed000)
libnsl.so.1 => /lib64/libnsl.so.1 (0x00002af907701000)
libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00002af90791a000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00002af907b52000)
libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00002af907d67000)
libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00002af907f96000)
libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00002af90822b000)
libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00002af908450000)
libc.so.6 => /lib64/libc.so.6 (0x00002af908653000)
libaudit.so.0 => /lib64/libaudit.so.0 (0x00002af9089ac000)
/lib64/ld-linux-x86-64.so.2 (0x00002af90696b000)
libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00002af908bc4000)
libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00002af908dcd000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x00002af908fcf000)
libsepol.so.1 => /lib64/libsepol.so.1 (0x00002af9091e8000)
$ rpm -qa|grep openssh-server
openssh-server-4.3p2-82.el5
$ sudo /usr/sbin/sshd -p 22222 -d -d
debug2: load_server_config: filename /etc/ssh/sshd_config
debug2: load_server_config: done config len = 655
debug2: parse_server_config: config /etc/ssh/sshd_config len 655
debug1: sshd version OpenSSH_4.3, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: private host key: #0 type 0 RSA1
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-p'
debug1: rexec_argv[2]='22222'
debug1: rexec_argv[3]='-d'
debug1: rexec_argv[4]='-d'
Set /proc/self/oom_adj from 0 to -17
debug2: fd 3 setting O_NONBLOCK
debug1: Bind to port 22222 on ::.
Server listening on :: port 22222.
ldd /usr/sbin/sshd
, just in case it's a privilege issue, and possibly the output ofrpm -qV openssh-server
as well?ldd /usr/sbin/sshd
, as I'd asked? In any case, it looks as if someone's modified thesshd
binary - the filesize and MD5 checksum are wrong.