delete file operation not permitted

Question

I am using Ubuntu 16LTS and performed a regular upgrade with apt. The upgrade failed with openssh-server and apt complained it could not upgrade because it cannot make a backup of /usr/sbin/sshd

I removed openssh-server and tried to reinstall it. No luck and apt comes back with the same message. I remove openssh-server again.

When I try to manually change or remove /usr/sbin/sshd I get the message that "Operation is not permitted". I tried to remove the attribute chattr -a -i /usr/sbin/sshd but it keeps responding that the operation not permitted. An other annoying issue is that lsattr does not give back any info.

How can I force a delete or move of the /usr/sbin/sshd file?

Answer 1

The following command will show you which process lock a specific file:

sudo lsof /usr/sbin/sshd

If the result of lsof will give you sshd service than you should stop the service before performing the upgrade.

Assuming the you tried to remove sshd while it is still running, you can try to stop sshd first.

Using:

sudo /etc/init.d/ssh stop

or

sudo service ssh stop

After the service is stopped, you can try to upgrade via apt or remove the folder manually.

Answer 2

I found the solution myself. Apearently the lsattr and chattr files where damaged. Maybe I was hacked. When I replaced the two files with the correct version I could remove the -i flag and I could remove sshd.

Thanks for the help Yaron.