Re: [cobalt-users] ssh stopped working and can't login as root

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Thu, 21 Feb 2002, Jane Meeker wrote:
<snip>
> Two days ago SSH stopped working.  I turned on telnet and I can telnet
in  > but not as root.
> 
> In the logs I see this:
> 
> Feb 19 20:40:24 www sshd2[18319]: WARNING: Host key pair is not specified, 
> trying to use default 'hostkey'.
> Feb 19 20:40:24 www sshd2[18319]: Listener created on port 22.
> Feb 19 20:40:24 www sshd2[18325]: Daemon is running.
> Feb 19 20:40:48 www sshd2[18326]: Local disconnected: Illegal protocol 
> version.
> Feb 19 20:40:48 www sshd2[18326]: protocol version not supported in local: 
> 'Illegal protocol version.'
> AND
> Any idea what these accounts are for?
> dns:x:500:500::/home/dns:/bin/bash
> tcp:x:0:0::/bin:/bin/bash

The tcp accouunt is running with root provlidges
For the record,
Which version of ssh are  (were) you runing?
Which version of bind are you running?
What does netstat -tupan look like?, and strange processes running?

It looks to me like you may have been hacked.
Do you have chkrootkit installed?
If so run it and you may get more information.

--
Gerald Waugh