determine if secure shell (sh) is installed

[ernest tamura]

We just received a message about a problem with secure shell (sh). We do not use it but want to verify that it has not been installed. How can we verify that it has not been installed.

[Craig Rants · Accepted solution]

Usually it will be in /usr/local/bin or /opt/openssh2/bin. I would run a few commands.

find / -name sshd

ps -ef |grep sshd

netstat -an | grep 22 | grep LISTEN | more

If any of these are successful then you have it installed. It is not a default app so if you have not installed it then it probably is not there.

I would recommend using it over rlogin or telnet, good security practice.

MC,
C

[Darrell Allen]

Hi Ernest,

Since it could be installed anywhere:

find / -name "ssh*"

Darrell

[Michael Tully]

Hi,

Openssh (or ssh) Depending on how it was installed.....

If it had been installed using a depot from say
from the HP porting centre, it would show up in the output of swlist.

# swlist -l product

Failing that, have a look in the system startup
directory /sbin/init.d for anything that resembles this

user@metsco5:/sbin/init.d 6 $ ll /sbin/init.d/ssh*
-rwxr-xr-x 1 root sys 1975 Sep 11 09:31 /sbin/init.d/sshd.rc

Processes that would be running

user@system:/home/user 3 $ ps -ef |grep ssh
root 871 1 0 Dec 10 ? 0:00 /opt/openssh2/sbin/sshd

Failing that do a find for any user home directory that contains the keys

# find /home -name identity -print

HTH
-Michael

[Steven Sim Kok Leong]

Hi,

To determine if it is running:

# telnet localhost 22

If running, this will show connected and
the version number will also be displayed.

Michael was showing the file locations for the OpenSSH implementation, there is another SSH implementation from SSH Communications Security Ltd (http://www.ssh.fi).

To determine if this (SSH Communications) has been installed, search the following files:

# ls -la /usr/local/sbin/sshd

The other files are:

# ls -la /usr/local/bin/ssh*
# ls -la /usr/local/bin/scp*
# ls -la /etc/ssh2/*

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Eugen Cocalea]

Hi,

'sh' is not a secure shell, it's a plain shell. 'ssh' is a secure shell (Secure SHell).

Anyway, there are several ways to disguise a ssh daemon but you can always see if it is running by doing a
netstat -an|grep *.22

22 is the port that ssh use on the server side.

Since this is a <1024 port, only root can assign it to a service so if anyone else has the root pass on your machine, maybe (s)he installed it. Else, sshd cannot be run as a plain user.

A
find / -name sshd
will try to find the ssh daemon file but it can fail if someone changed the name of the file.

You can check the existance of config files in /etc and user-setup files in home dirs.

Anyway, if you don't use it (yet) you would better do.

E.

[Darrell Allen]

Hi again,

As stated, sshd normally listens on port 22. Just note that SSH is highly configurable and the port can be changed as well. I've supported systems where the developers put in their own modified version of SSH listening on a different port. This was in addition to our "standard" version.

Darrell