1

So I have this weird issue where one of my boxes is accepting connection on the ssh port (22) even after sshd is stopped. I tried to identify the listening process by the typical means

sudo netstat -antp | grep 22  # nothing
sudo unhide-tcp   # no hidden tcp ports

When I try to connect to port 22, it asks for a password even though I have setup key based authentication on this machine.

I'm afraid if there is a rootkit or some similar malware on my machine.

Have you seen something like this before?

OS - Ubuntu 14.04 LTS

Improve this question
7
  • try from from root, without using sudo, for example sudo su - and after netstat -tunap | grep ssh
    – c4f4t0r
    May 8, 2015 at 6:23
  • 1
    Does ssh -vvv reveal anything useful when connecting ? (target redirection, authentication methods tried, etc.. )?
    – b0fh
    May 8, 2015 at 6:30
  • 2
    Do you have checked your settings in inetd/xinetd?
    – Uwe Plonus
    May 8, 2015 at 6:49
  • 1
    @UwePlonus won't inetd/xinetd show up in netstat?
    – madaboutcode
    May 8, 2015 at 8:42
  • 1
    @XavierLucas That's what I did. I ended up rebuilding the machine from a fresh image.
    – madaboutcode
    May 13, 2015 at 10:24

2 Answers 2

Reset to default
1

If this is indeed a hidden process, and you are not making some sort of mistake (like inetd mentioned above by Uwe), try this:

  • Bombard port 22 with a lot of bogus connections directly from ethernet
  • See what pops up in top
  • If nothing pops up, at least see if the load goes up significantly

For all of this to happen you must quench the rest of the traffic, so on a production server this can be problematic.

Improve this answer
0

Even if you have setup key based authentication mechanism - it should be via a protocol such as ssh. but in your case can you pls try below:

Login to server and

tail -f /var/log/secure

then from another terminal try to login and see what are the logs recorded there.

Check if SSH is configured to listen on another port as well -- in sshd_config file

Check iptables -- see if there is any port forwarding check process

sudo ps -ef |grep -i ssh

Check again with netstat all processes carefully

netstat -tulpn

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .