Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log

[14:38:54]   Checking if SSH protocol v1 is allowed          [ Warning ]
[14:38:54] Warning: The SSH configuration option 'Protocol' has not been set.
           The default value may be '2,1', to allow the use of protocol version 1.

When i checked with /etc/ssh/ I found 2 config files, sshd_config and ssh_config.

ssh_config last modified on 21-Sep-2013 (22:30).

rkhunter result of 21-Sep-2013 (04:20)

[04:10:40]   Checking if SSH root access is allowed          [ Not set ]
[04:10:40]   Checking if SSH protocol v1 is allowed          [ Not allowed ]

I'm worried that my server maybe compromised.

Update

After run clamav scan on server, I found /usr/sbin/sasluster (Stealth MultiFunctional IrcBot).

How do I remove it? What does it mean?

share|improve this question
    
To disable protocol v1 and enforce protocol v2 only, you can follow this guide support.hoststore.com/… –  Adnan Sep 25 '13 at 10:44
    
As a note, having both sshd_config and ssh_config is totally normal provided you have both the "server" and "client" installed. sshd_config is the config file for sshd (the daemon) and ssh_config is the config file for your ssh client. –  skerp Sep 25 '13 at 11:29
    
possible duplicate of How do I deal with a compromised server? –  Lucas Kauffman Sep 26 '13 at 7:45
1  
@LucasKauffman No, How do I deal with a compromised server? is not a duplicate (but Kumar, this is what you need to do). This question is not about a compromised server. (Well, it turns out that the server is compromised, but that's not what the question is about.) –  Gilles Sep 26 '13 at 9:39

1 Answer 1

Going by what you originally posted about SSH, there is no evidence there that your server is compromised. It would be quite a round-the-houses way of breaking SSH for an attacker to resort to a default configuration.

This is simply a warning message that your sshd or ssh might be misconfigured. RKHunter could not find a configuration value for the Protocol key, and is simply warning you that the default might not be great for security.

You should edit your sshd_config and ssh_config files and add a Protocol 2 line to avoid getting this warning in the future by explicitly disabling protocol 1.


So you have evidence that your SSH config file has altered. This is almost certainly the result of an update, if someone has run an apt-get upgrade and then said yes when asked about a config overwrite, this can happen.

You should check the rest of your sshd_config however just to make sure that everything is as it should be, particularly disallowing root login. Also check /etc/passwd to see if any new users have been created, and /etc/sudo for the same reasons.


If your server does turn out to be compromised, this is unlikely to be related to the warning about SSH.

share|improve this answer
    
Please check added details about rkhunter log. Actually we not did anything in that mean time. That's why... –  Kumar Sep 25 '13 at 10:58
    
@ This is additional thing I got in log, Warning: File '/usr/bin/chattr' has the immutable-bit set. Didn't have this in previous log in 21-Sep-2013 (04:20). –  Kumar Sep 25 '13 at 11:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.