Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I run a Centos 5 server with a LAMP stack. I was told this morning that the server was down not serving web content. I then tried to restart httpd but it failed due to another process was listening on port 443. I checked what process was running on 443 using netstat and it was sshd. I then checked the sshd_config file to check the ports that sshd was running on but the sshd_config file was completely blank.

I than ran chkrootkit and it flagged not suspicions. What could of caused the sshd_config file to be blank, and sshd service to be restarted?

I would really value your thoughts.

All the best.

share|improve this question
    
type "ps ax | grep sshd" to see if sshd has been forced to use an alternate config file and paste the result –  m0ntassar Jun 12 '12 at 9:48
    
Thanks for getting back to me. I've repopulated the SSHD config file and is now listening on port 22 again so I think ps aux | grep sshd will not be much use. –  Thomas Jun 12 '12 at 9:55
    
ok, but you have to seriously investigate on that issue, sshd wouldn't decide to listen on 443 by itself if you see what I mean –  m0ntassar Jun 12 '12 at 10:01
    
Files doesnt erase them selfs.. something bad happened and you should find what it was –  B14D3 Jun 12 '12 at 10:01
    
Yes exactly, I am investigating the issue :) that's why I'm asking you chaps for your input.Just crawling all over the logs now. –  Thomas Jun 12 '12 at 10:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.