up vote 0 down vote favorite
share [g+] share [fb]

i get segmentation fault when i try to ssh to a server, the ssh works in sudo mode but not at user mode.

these are the strace bits where the ssh breaks

open("/usr/include/pwd2.h", O_WRONLY|O_CREAT|O_APPEND|O_LARGEFILE, 0666) = -1 EACCES (Permission denied)
getpeername(3, {sa_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("xxx.xxx.xxx.xx")}, [16]) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

can anyone give me ideas about the problem?

link|improve this question
45% accept rate
feedback

3 Answers

up vote 0 down vote accepted

can anyone give me ideas about the problem?

Check packages:

# debsums openssh-server
/usr/share/lintian/overrides/openssh-server                                   OK
/usr/share/man/man5/sshd_config.5.gz                                          OK
/usr/share/man/man8/sshd.8.gz                                                 OK
/usr/share/man/man8/sftp-server.8.gz                                          OK
/usr/lib/openssh/sftp-server                                                  OK
/usr/sbin/sshd                                                                OK

Reinstall/upgrade openssh-server:

sudo apt-get --reinstall install openssh-server

Use gdb/valgrind to debug.

link|improve this answer
cool thanks, there was a problem in debsums, reinstall ssh and it works now!!! – krisdigitx Feb 1 '11 at 13:58
feedback
up vote 0 down vote

Man, you've got rootkit, reinstall!. Your ssh binary is trying to write down every password its using to that file, also keep in mind that every password that you see there was compromised.

link|improve this answer
It is a possibility, you can not be sure at this moment... – Bart De Vos Nov 22 '11 at 13:45
I had the same rootkit :/. Actually, why on earth the ssh client needs to write into a file suspiciously similar to /usr/include/pwd.h. I also traced one execution and saw the same, and the contents of the file was the password I used + the user + the hostname. These are the md5 of the files comprimised 5e080eb6c5aaef7e577cd37489080830 /usr/bin/ssh 337e9724f9eb005d2b8d4061284b1ae6 /usr/sbin/sshd – magec Nov 23 '11 at 10:13
feedback
up vote -1 down vote

It'd be much clearer to come up with coredump which later can be analyzed.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.