"/etc/ssh/sshd_config" is always modified by other process

Question

I am not familiar with sshd process; and I am trying to enable remote ssh login without password, and I have inserted my public key in ~/.ssh/authorized_keys on the server side, and it works on one of the remote system, not the other.

I noticed the following entries in my /etc/ssh/sshd_config on the non-working remote system,

#AuthorizedKeysFile .ssh/authorized_keys
AuthorizedKeysFile /var/ssh/%u/ak

since I have my public key inserted in .ssh/authorized_keys, I tried to change the above to

AuthorizedKeysFile .ssh/authorized_keys
AuthorizedKeysFile /var/ssh/%u/ak

This seems to allow me to remote ssh without password, however, I noticed that the file was reset back every few hours, and I have to key in password for SSH again.

any idea what is happening with the config file here?

Thanks!

Answer 1

• You could use tools implementing fanotify() kernel APIs. For instance fanotify-cmd works perfectly. There's no need to edit any system files or parse logs.

  ./fm -a /etc/passwd
  checking for events FAN_ACCESS
  mask: FAN_ACCESS, fd: 4, pid: 203188, file: /etc/passwd, command: bash 
  mask: FAN_ACCESS, fd: 4, pid: 203190, file: /etc/passwd, command: 
  mask: FAN_ACCESS, fd: 4, pid: 203321, file: /etc/passwd, command: ls --color=auto -l /etc/passwd
  

  Ubuntu and Fedora include fatrace which is a really nice well maintained utility.

  sudo fatrace --timestamp --filter=WD
  

• Or you could useauditd. Since it's a system daemon, you'll need to edit an auditd system configuration file in /etc. There are plenty of manuals on the net how to use them, e.g. on stackexchange itself.

  inotifywait unfortunately doesn't work for this use case as it merely shows the files being accessed or modified, it doesn't show what process does it.