Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i get segmentation fault when i try to ssh to a server, the ssh works in sudo mode but not at user mode.

these are the strace bits where the ssh breaks

open("/usr/include/pwd2.h", O_WRONLY|O_CREAT|O_APPEND|O_LARGEFILE, 0666) = -1 EACCES (Permission denied)
getpeername(3, {sa_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("")}, [16]) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

can anyone give me ideas about the problem?

share|improve this question
up vote 0 down vote accepted

can anyone give me ideas about the problem?

Check packages:

# debsums openssh-server
/usr/share/lintian/overrides/openssh-server                                   OK
/usr/share/man/man5/sshd_config.5.gz                                          OK
/usr/share/man/man8/sshd.8.gz                                                 OK
/usr/share/man/man8/sftp-server.8.gz                                          OK
/usr/lib/openssh/sftp-server                                                  OK
/usr/sbin/sshd                                                                OK

Reinstall/upgrade openssh-server:

sudo apt-get --reinstall install openssh-server

Use gdb/valgrind to debug.

share|improve this answer
cool thanks, there was a problem in debsums, reinstall ssh and it works now!!! – krisdigitx Feb 1 '11 at 13:58

Man, you've got rootkit, reinstall!. Your ssh binary is trying to write down every password its using to that file, also keep in mind that every password that you see there was compromised.

share|improve this answer
It is a possibility, you can not be sure at this moment... – Bart De Vos Nov 22 '11 at 13:45
I had the same rootkit :/. Actually, why on earth the ssh client needs to write into a file suspiciously similar to /usr/include/pwd.h. I also traced one execution and saw the same, and the contents of the file was the password I used + the user + the hostname. These are the md5 of the files comprimised 5e080eb6c5aaef7e577cd37489080830 /usr/bin/ssh 337e9724f9eb005d2b8d4061284b1ae6 /usr/sbin/sshd – magec Nov 23 '11 at 10:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.