unix shell (SSH) not prompting for password

[badgerbox76]

Hello i have setup my system using the ubuntu ispconfig guide and was testing out some of the apps. When i connect to ssh useing putty a command window pops up with out me having to enter any password. Althrough i cant enter any commands it just sits there. How can i fix this problem?

[till]

Is there a command prompt in the window or does the window times out with a connection error after some minutes?

[badgerbox76]

I enter in the ip of my server and click connect then a back window with a green cursor shows up in the right corner of the screen. i cant type in any commands and it will just sit there. so what is going on?

[falko]

Please post the output of

netstat -tap

from your server.

[badgerbox76]

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 localhost.localdo:32769 *:* LISTEN -
tcp 0 0 localhost.localdo:32770 *:* LISTEN -
tcp 0 0 localhost.localdo:mysql *:* LISTEN -
tcp 0 0 *:netbios-ssn *:* LISTEN -
tcp 0 0 *:81 *:* LISTEN -
tcp 0 0 localhost.localdom:7634 *:* LISTEN -
tcp 0 0 *:ftp *:* LISTEN -
tcp 0 0 monitorwaves.no-:domain *:* LISTEN -
tcp 0 0 localhost.locald:domain *:* LISTEN -
tcp 0 0 localhost.localdoma:ipp *:* LISTEN -
tcp 0 0 localhost.localdoma:953 *:* LISTEN -
tcp 0 0 *:smtp *:* LISTEN -
tcp 0 0 *:microsoft-ds *:* LISTEN -
tcp 0 0 monitorwaves.no-i:42405 66.117.38.132:20046 TIME_WAIT -
tcp 0 0 monitorwaves.no-i:53088 209.50.189.200:www ESTABLISHED13186/firefox-bin
tcp 0 0 localhost.localdoma:ipp localhost.localdo:58372 ESTABLISHED-
tcp 0 0 monitorwaves.no-i:43849 72.14.219.104:www ESTABLISHED13186/firefox-bin
tcp 1 0 localhost.localdo:53272 localhost.localdoma:ipp CLOSE_WAIT -
tcp 0 0 monitorwaves.no-i:44877 64.233.179.99:www ESTABLISHED13186/firefox-bin
tcp 0 0 localhost.localdo:35295 localhost.localdo:32769 ESTABLISHED-
tcp 1 0 localhost.localdo:40186 localhost.localdoma:ipp CLOSE_WAIT -
tcp 0 0 localhost.localdo:58372 localhost.localdoma:ipp ESTABLISHED7989/gnome-cups-ico
tcp 0 0 monitorwaves.no-i:48062 63.236.80.73:www TIME_WAIT -
tcp 0 0 localhost.localdo:32769 localhost.localdo:35295 ESTABLISHED-
tcp6 0 0 *:imaps *:* LISTEN -
tcp6 0 0 *op3s *:* LISTEN -
tcp6 0 0 *op3 *:* LISTEN -
tcp6 0 0 *:imap2 *:* LISTEN -
tcp6 0 0 *:www *:* LISTEN -
tcp6 0 0 *:tproxy *:* LISTEN -
tcp6 0 0 *:ssh *:* LISTEN -
tcp6 0 0 ip6-localhost:953 *:* LISTEN -
tcp6 0 0 *:https *:* LISTEN -
admin@monitorwaves:~$

[badgerbox76]

ok for some reson out of the blue my website stoped working! i have not changed any thing.

this is what i get when trying to view the page!

Your browser sent a request that this server could not understand.

Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.

and now when i try connecting to the ssh i get a user name login

have i been hacked?

[falko]

You can scan your system for rootkits/trojans, etc. like this: http://www.howtoforge.com/faq/1_38_en.html

[badgerbox76]

Ok once i get home i will install the software and have a scan.

Its weird when i got home my site was down and i tryed a ssh login and when i did i get the UserLogin:_________ which i did not enter any information in cause it was some kind of hack. I have rewritten the ssh keys and it the site is back up again, but now i dont get the UserLogin:_______ when i try to connect via ssh. So how can i fix the problem?

[till]

Do you work with preshared SSH kys or with username / password login? If you installed preshared keys, there will be no login prompt.

[badgerbox76]

My web server was working when i was at school but now it again was stoped. I have not changed any settings since it was working last. I have also scanned my system here is my out put.

* Check: SSH
   Searching for sshd_config...
   Found /etc/ssh/sshd_config
   Checking for allowed root login... Watch out Root login possible. Possible risk!
    info: PermitRootLogin yes
    Hint: See logfile for more information about this issue
   Checking for allowed protocols...                          [ OK (Only SSH2 allowed) ]
* Filesystem checks
   Checking /dev for suspicious files...                      [ OK ]
   Scanning for hidden files...                               [ Warning! ]
 Checking boot.local/rc.local file...
     - /etc/rc.local                                          [ Not found ]
     - /etc/rc.d/rc.local                                     [ Not found ]
     - /usr/local/etc/rc.local                                [ Not found ]
     - /usr/local/etc/rc.d/rc.local                           [ Not found ]
     - /etc/conf.d/local.start                                [ Not found ]
     - /etc/init.d/boot.local                                 [ Not found ]
   Checking rc.d files...                                     [ Not found ]

How can i fix the ssh problems? And are there any howtos on setting up snort?