gpg: failed to create temporary file '/var/lib/lurker/.#lk0x56ac4100.hantslug.org.uk.19256': Permission denied
gpg: keyblock resource '/var/lib/lurker/pubring.gpg': Permission denied
gpg: Signature made Tue Jan 25 13:38:42 2011 GMT
gpg: using DSA key 20ACB3BE515C238D
gpg: Can't check signature: No public key
On Tue, Jan 25, 2011 at 08:30:43AM -0500, Andy Random wrote:
> I'm not sure when this happened but I've just tried to ssh out from
> a machine and got the following:
>
> $ ssh
> -bash: /usr/bin/ssh: Permission denied
>
> a quick check reveals:
>
> $ ls -ltr /usr/bin/ssh
> -rwx------ 1 root root 650556 Jan 10 13:54 /usr/bin/ssh
>
> so I tried this:
>
> # chmod 755 /usr/bin/ssh
> chmod: changing permissions of `/usr/bin/ssh': Operation not permitted
>
> This is on a VPS running Debian lenny which I've certainly managed
> to ssh out of before but I probably haven't tried to ssh out of the
> machines for a week or two so I'm not sure when the problem started.
> However I did an upgate/upgrade yesterday.
>
> Any ideas what is going on?
The file's been modified recently, and the binary is a lot larger
than it is on my system here(*). I'd hazard a guess you've been
cracked. Check for rootkits and unexpected processes or net
connections.
Hugo.
(*) I have:
hrm@shades:~$ ls -l /usr/bin/ssh
-rwxr-xr-x 1 root root 358756 Dec 26 18:12 /usr/bin/ssh
--
=== Hugo Mills: hugo@... carfax.org.uk | darksatanic.net | lug.org.uk ===
PGP key: 515C238D from wwwkeys.eu.pgp.net or http://www.carfax.org.uk
--- Q: What goes, "Pieces of seven! Pieces of seven!"? A: ---
A parroty error.
