nick zeljkovic kppyozizjtsite5com seen something odd principal server suse 100 dmz first saw user running ftp_scan zillion ports saw different user running ssh_scan thinks right started changing passwords rebooting notice freshly booted system root 4137 1 0 1416 000000 usrsbinsshd pidfilevarrunsshdinitpid jan 4755 1 0 1417 000000 usrsbinsshd netstat tells tcp 0 0 22 listen 4137sshd udp 0 0 000032775 0000 4755sshd unexpected sshd udp port 32775 open odd user jan running anything let alone sshd kill comes back checked usrsbinsshd correct checksum compared internal machine looked inittab rc scripts process 1 init see anything looks odd see anything gives clue running course rc scripts harder check run programs run programs etc check see different installed rpms nothing looked odd look httpsuseforumsnetindexphpshowtopic31358 seems describing thing except case odd sshd still running reboot go away anyone seenheard specific exploit roger oberholtzer lsof p pid see located best guess would perl script forking kill find source file remove best regards nick zeljkovic thu 07 aug 2008 150348 0100 opensuse system seems hacked