OS: Centos 7.4

End goal: Install openssh-server

current issue: removing previous copy of sshd

Preceding scenario: openssh-server would not update due to yum errors. I attempted to remove openssh-server and then install it via yum in hopes that starting from scratch would clear up any issues. However the current problem is the same as the original.

Issue: When trying to install openssh-server, I get an error when Yum tries to rename the existing sshd file:

Installing : openssh-server-7.4p1-13.el7_4.x86_64                                                                                            1/1 
Error unpacking rpm package openssh-server-7.4p1-13.el7_4.x86_64
error: unpacking of archive failed on file /usr/sbin/sshd: cpio: rename

I assume the installer is trying to rename the old file before it can install its version. So I tried to rename it myself as root:

mv /usr/sbin/sshd /usr/sbin/sshd.old
mv: cannot move ‘/usr/sbin/sshd’ to ‘/usr/sbin/sshd.old’: Operation not permitted

My first though is that maybe items in the /usr/sbin directory are immutable. However I am able to rename other files in there (I renamed them back!) And I was able to rename sshd on other centos 7 servers.

In doing research I found recommendations to run the command lsattr. However no matter what file/directory I run this command on, there is no output. I have tried running it on other Centos 7 servers and it works there.

The same seems to be for chattr, though I am not sure it is should display anny output. Without the use of lsattr, I cannot confirm if chattr did anything. I ran the following command with the though that perhaps /usr/sbin/sshd is immutable:

chattr -i /usr/sbin/sshd

The file still cannot be renamed. I am executing all commands as root, the file is owned by root and has r/w/x permissions for root.

-rwxr-xr-x. 1 root root     500K Dec 30 21:08 sshd

Also, there are no processes running as sshd according to lsof or ps.

I am not really sure what to make of this, and perhaps my question should be about lsattr not outputting anything instead of this question. I suspect I will need to provide additional info, but not sure what. So I will try to update the question with more info upon request. Anyone have any recommendations on things I can try to troubleshoot this further?

  • The most common reason for lsattr to not give you any output is that the server has been compromised. Blow it away. – Michael Hampton Jan 4 '18 at 22:54
  • that of course is always a possibility, however the server is pretty new. And the only publicly accessible port is ssh which only allows connections from a specific IP. Its on a rackspace account which gets set up through rackspace so I am wondering if this could be some kind of policy in their default installation perhaps? I don't suppose selinux in permissive mode could do anything could it? – C Miller Jan 4 '18 at 23:10
  • If the server is recently installed, I'd consider running rpm -Va and investigating any discrepancies. – Michael Hampton Jan 4 '18 at 23:11

OK, so here was my solution for this problem:

I made new copies of lsattr and chattr. I used those copies to fix the attributes on the system copies of those programs. I deleted the system copies and replaced them with my new copies. I then used chattr to fix the attributes for /usr/sbin/sshd I removed /usr/sbin/sshd I installed openssh-server via Yum.

The 3 problem files had the a and u attr flags set on them. I needed to upload new copies because the files for changing the attributes were themselves broken.

  • 1
    That pretty much proves the server was compromised. – Michael Hampton Feb 10 '18 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.