Bill Campbell wrote: ... > That would make me very suspicious that the box had been cracked, > and that a foreign sshd had been substituted for the real one. > > rpm -V is your friend. Also rkhunter and chkrootkit.