text_combined: roger oberholtzer drtyuopqse seen something odd principal server suse 100 dmz first saw user running ftp_scan zillion ports saw different user running ssh_scan thinks right started changing passwords rebooting notice freshly booted system root 4137 1 0 1416 000000 usrsbinsshd pidfilevarrunsshdinitpid jan 4755 1 0 1417 000000 usrsbinsshd netstat tells tcp 0 0 22 listen 4137sshd udp 0 0 000032775 0000 4755sshd unexpected sshd udp port 32775 open odd user jan running anything let alone sshd kill comes back checked usrsbinsshd correct checksum compared internal machine looked inittab rc scripts process 1 init see anything looks odd see anything gives clue running course rc scripts harder check run programs run programs etc check see different installed rpms nothing looked odd look httpsuseforumsnetindexphpshowtopic31358 seems describing thing except case odd sshd still running reboot go away anyone seenheard specific exploit roger oberholtzer opq systems ramböll rst ramböll sverige ab kapellgränd 7 po box 4205 se102 65 stockholm sweden office int 46 8615 60 20 mobile int 46 70815 1696 thu 07 aug 2008 145840 0100 opensuse system seems hacked