2

Ubuntu Server can't be upgraded because it says that openssh-sftp-server package have unmet dependencies

The following packages have unmet dependencies:
 openssh-sftp-server : Depends: openssh-client (= 1:8.2p1-4ubuntu0.2) but 1:8.2p1-4ubuntu0.1 is installed

When I try to use apt --fix-broken install to install what is missing I receive the following output:

...
dpkg: error processing archive /var/cache/apt/archives/openssh-server_1%3a8.2p1-4ubuntu0.2_amd64.deb (--unpack):
 unable to make backup link of './usr/sbin/sshd' before installing new version: Operation not permitted
...
dpkg: error processing archive /var/cache/apt/archives/openssh-client_1%3a8.2p1-4ubuntu0.2_amd64.deb (--unpack):
 unable to make backup link of './usr/bin/ssh' before installing new version: Operation not permitted
...

Investigating I found that both files have the immutable attribute.

$:~# lsattr /usr/bin/ssh
----i---------e----- /usr/bin/ssh
$:~# lsattr /usr/sbin/sshd
----i---------e----- /usr/sbin/sshd

Everytime I try to change attribute of '/usr/bin/ssh' or '/usr/sbin/sshd' with the command chattr -i /usr/bin/ssh or chattr -i /usr/sbin/sshd several processes spawns throwing ... chattr +i /usr/bin/chattr ... /usr/bin/ssh /usr/sbin/sshd (as can be seen in the image below).

chattr processes spawned

The process is also changing attributes of the following files.

----i---------e----- /usr/share/doc/libbasechattr.0.so.2
----i---------e----- /usr/share/doc/libchattr-1.0.so
----i---------e----- /usr/bin/chattr

I can't find information on the Web for the terms libbasechattr and libchattr.

I found the same behavior in two unrelated machines that are on different sites and don't communicate directly.

System details:

  • Ubuntu Server 20.04.02 LTS
  • Kernel Linux 5.4.0-66-generic #74-Ubuntu SMP Wed Jan 27 22:54:38 UTC 2021 x86_64
  • OpenSSH_8.2p1, OpenSSL 1.1.1f 31 Mar 2020
  • Filesystem is ext4 in one machine and btrfs in the other.

Has anyone experienced this before, is this a bug or an attack?

1 Answer 1

2

There’s no reason to have libraries in /usr/share/doc, and as you point out, the “libraries” (which probably aren’t libraries, given the command shown in your htop screenshot) aren’t referenced anywhere. This is extremely likely to be an attack.

See this answer and the links therein for details of what you should do now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .