[CLUE-Tech] sshd

[David Anselmi]

Mike Staver wrote:
> I just ended up uninstalling the rpms for ssh and reinstalling them, and 
> it's fine now.  When I did a:
> 
> locate ssh
> 
> It returned this directory:
> 
> /etc/ssh/ssh-config

Locate (slocate) won't show files you can't read.  The sshd config file 
is /etc/ssh/sshd_config.  Also on RH sshd logs to /var/log/secure though 
there probably isn't any better info there than in messages.

> Well, when I tried to look at it, /etc/ssh didn't exist.  So, the reason 
> ssh wouldn't start is because that directory magically disappeared... 
> which bothers me.  I just reinstalled it, and it's fine for now, but I'm 
> still wondering how it went away to begin with.

The sshd script does check that the server keys exist (in /etc/ssh) and 
generates them if they don't.  Which fails if /etc/ssh doesn't exist.

You can look in users' history files for commands that might have 
removed that directory.  You can also look at the sudo logs if you use that.

Dave