[Cialug] Suspicious Server

[Jonathan C. Bailey]

I've got a server that was acting a bit suspicious... I could SSH to it and navigate through files (ls/cd/cat/tail) without any issue, but if I tried to run a utility like ps/w/kill/chkrootkit, the SSH session would just hang. I rebooted the box and all seems to be fine and chkrootkit doesn't show anything out of place. The other utilities work as normal. This machine only has port 22 open to the world and only allows public key auth to it. Any thoughts on if this is truly suspicious, or is there something else that could cause these commands to just hang?


-Jon