Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i cannot connect to my server via ssh, it throws me a "server unexpectedly closed connection" after entering the password.

in var/log/messages the only noteable message is:

Apr 14 17:41:23 s15410270 kernel: sshd[3602]: segfault at c0 ip 7f0801acbdb0 sp 7fff0adff860 error 4 in[7f0801a87000+14f000]
Apr 14 17:41:29 s15410270 kernel: sshd[3606]: segfault at c0 ip 7f75f9463db0 sp 7fff027971f0 error 4 in[7f75f941f000+14f000]

This message appears after a log in attempt via ssh or via sftp

Its a SuSE Linux server. I'm looking for help where to start to search for the error, i can still act as root via a serial console.

edit: "server unexpectedly closed connection" only appears if i enter the correct password!

share|improve this question
up vote 2 down vote accepted

Check to make sure you weren't compromised. Run an rpm verify on your ssh daemon... You may also want to get a tool like chkrootkit installed and running.

rpm -vV openssh | grep 'S\.5' should work for SuSE. Post the output.

Also see the details posted in: sshd running but no PID file

share|improve this answer
Thanks! S.5..... c /etc/ssh/ssh_config S.5..... c /etc/ssh/sshd_config S.5....T /usr/bin/ssh S.5....T /usr/sbin/sshd I'll install chkrootkit, rkhunter did run the last on 09'th april and found nothing. – trampi Apr 14 '12 at 16:48
Your ssh and sshd binaries have been modified. The system has probably been compromised. You can download the openssh rpm for your system and force reinstall it by hand (rpm -ivh --force openssh*rpm) to get past the initial issue, but you will need to determine the extent of the damage. – ewwhite Apr 14 '12 at 16:53
Alright, i'll tell it the guy who is responsible for the servers. Thanks! – trampi Apr 14 '12 at 17:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.