marcus meissner xullbgtvsusede thu feb 21 2008 031209pm 0100 roger oberholtzer wrote seen something odd principal server suse 100 dmz first saw user running ftp_scan zillion ports saw different user running ssh_scan thinks right started changing passwords rebooting notice freshly booted system root 4137 1 0 1416 000000 usrsbinsshd pidfilevarrunsshdinitpid jan 4755 1 0 1417 000000 usrsbinsshd netstat tells tcp 0 0 22 listen 4137sshd udp 0 0 000032775 0000 4755sshd unexpected sshd udp port 32775 open odd user jan running anything let alone sshd kill comes back checked usrsbinsshd correct checksum compared internal machine looked inittab rc scripts process 1 init see anything looks odd see anything gives clue running course rc scripts harder check run programs run programs etc check see different installed rpms nothing looked odd programs rename process list symlink proc4755exe point might kind trojandaemonservices user trying hide ciao marcus unsubscribe email assipqffnmekprykassopensuseorg additional commands email qybuovjskcmhopensuseorg thu 07 aug 2008 145953 0100 opensuse system seems hacked