topic Re: determine if secure shell (sh) is installed in Operating System - HP-UX

determine if secure shell (sh) is installed

ernest tamura — Thu, 20 Dec 2001 22:15:24 GMT

We just received a message about a problem with secure shell (sh). We do not use it but want to verify that it has not been installed. How can we verify that it has not been installed.

Re: determine if secure shell (sh) is installed

Craig Rants — Thu, 20 Dec 2001 22:18:57 GMT

Usually it will be in /usr/local/bin or /opt/openssh2/bin. I would run a few commands.

find / -name sshd

ps -ef |grep sshd

netstat -an | grep 22 | grep LISTEN | more

If any of these are successful then you have it installed. It is not a default app so if you have not installed it then it probably is not there.

I would recommend using it over rlogin or telnet, good security practice.

MC,
C

Re: determine if secure shell (sh) is installed

Darrell Allen — Thu, 20 Dec 2001 22:25:18 GMT

Hi Ernest,

Since it could be installed anywhere:

find / -name "ssh*"

Darrell

Re: determine if secure shell (sh) is installed

Michael Tully — Thu, 20 Dec 2001 22:26:22 GMT

Hi,

Openssh (or ssh) Depending on how it was installed.....

If it had been installed using a depot from say
from the HP porting centre, it would show up in the output of swlist.

# swlist -l product

Failing that, have a look in the system startup
directory /sbin/init.d for anything that resembles this

user@metsco5:/sbin/init.d 6 $ ll /sbin/init.d/ssh*
-rwxr-xr-x 1 root sys 1975 Sep 11 09:31 /sbin/init.d/sshd.rc

Processes that would be running

user@system:/home/user 3 $ ps -ef |grep ssh
root 871 1 0 Dec 10 ? 0:00 /opt/openssh2/sbin/sshd

Failing that do a find for any user home directory that contains the keys

# find /home -name identity -print

HTH
-Michael

Re: determine if secure shell (sh) is installed

Steven Sim Kok Leong — Fri, 21 Dec 2001 01:29:29 GMT

Hi,

To determine if it is running:

# telnet localhost 22

If running, this will show connected and
the version number will also be displayed.

Michael was showing the file locations for the OpenSSH implementation, there is another SSH implementation from SSH Communications Security Ltd (http://www.ssh.fi).

To determine if this (SSH Communications) has been installed, search the following files:

# ls -la /usr/local/sbin/sshd

The other files are:

# ls -la /usr/local/bin/ssh*
# ls -la /usr/local/bin/scp*
# ls -la /etc/ssh2/*

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

Re: determine if secure shell (sh) is installed

Eugen Cocalea — Fri, 21 Dec 2001 08:21:36 GMT

Hi,

'sh' is not a secure shell, it's a plain shell. 'ssh' is a secure shell (Secure SHell).

Anyway, there are several ways to disguise a ssh daemon but you can always see if it is running by doing a
netstat -an|grep *.22

22 is the port that ssh use on the server side.

Since this is a <1024 port, only root can assign it to a service so if anyone else has the root pass on your machine, maybe (s)he installed it. Else, sshd cannot be run as a plain user.

A
find / -name sshd
will try to find the ssh daemon file but it can fail if someone changed the name of the file.

You can check the existance of config files in /etc and user-setup files in home dirs.

Anyway, if you don't use it (yet) you would better do.

E.

Re: determine if secure shell (sh) is installed

Darrell Allen — Fri, 21 Dec 2001 14:27:00 GMT

Hi again,

As stated, sshd normally listens on port 22. Just note that SSH is highly configurable and the port can be changed as well. I've supported systems where the developers put in their own modified version of SSH listening on a different port. This was in addition to our "standard" version.

Darrell