On Tue, Jan 25 at 08:30, Andy Random wrote:
...
> $ ls -ltr /usr/bin/ssh
> -rwx------ 1 root root 650556 Jan 10 13:54 /usr/bin/ssh
>
> so I tried this:
>
> # chmod 755 /usr/bin/ssh
> chmod: changing permissions of `/usr/bin/ssh': Operation not permitted
It's possible the "immutable" flag has been set on the file.
Some people think this improves security.
Check with lsattr, if it's set then clear it with chattr. Then you should
be able to chmod the file. See man pages as appropriate.
The next stage that would block root is a readonly filesystem but the
error message would normaly be different.
However if you didn't set the immutable bit I'd start to be concerned
that the system has been compromised. Especially as others have pointed
out that file size looks odd. Anything strange in the logs for Jan 10 ?
--
Bob Dunlop
