I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log

[14:38:54]   Checking if SSH protocol v1 is allowed          [ Warning ]
[14:38:54] Warning: The SSH configuration option 'Protocol' has not been set.
           The default value may be '2,1', to allow the use of protocol version 1.

When i checked with /etc/ssh/ I found 2 config files, sshd_config and ssh_config.

ssh_config last modified on 21-Sep-2013 (22:30).

rkhunter result of 21-Sep-2013 (04:20)

[04:10:40]   Checking if SSH root access is allowed          [ Not set ]
[04:10:40]   Checking if SSH protocol v1 is allowed          [ Not allowed ]

I'm worried that my server maybe compromised.


After run clamav scan on server, I found /usr/sbin/sasluster (Stealth MultiFunctional IrcBot).

How do I remove it? What does it mean?

  • To disable protocol v1 and enforce protocol v2 only, you can follow this guide support.hoststore.com/…
    – Adi
    Sep 25, 2013 at 10:44
  • As a note, having both sshd_config and ssh_config is totally normal provided you have both the "server" and "client" installed. sshd_config is the config file for sshd (the daemon) and ssh_config is the config file for your ssh client.
    – skerp
    Sep 25, 2013 at 11:29
  • possible duplicate of How do I deal with a compromised server? Sep 26, 2013 at 7:45
  • 1
    @LucasKauffman No, How do I deal with a compromised server? is not a duplicate (but Kumar, this is what you need to do). This question is not about a compromised server. (Well, it turns out that the server is compromised, but that's not what the question is about.) Sep 26, 2013 at 9:39

1 Answer 1


Going by what you originally posted about SSH, there is no evidence there that your server is compromised. It would be quite a round-the-houses way of breaking SSH for an attacker to resort to a default configuration.

This is simply a warning message that your sshd or ssh might be misconfigured. RKHunter could not find a configuration value for the Protocol key, and is simply warning you that the default might not be great for security.

You should edit your sshd_config and ssh_config files and add a Protocol 2 line to avoid getting this warning in the future by explicitly disabling protocol 1.

So you have evidence that your SSH config file has altered. This is almost certainly the result of an update, if someone has run an apt-get upgrade and then said yes when asked about a config overwrite, this can happen.

You should check the rest of your sshd_config however just to make sure that everything is as it should be, particularly disallowing root login. Also check /etc/passwd to see if any new users have been created, and /etc/sudo for the same reasons.

If your server does turn out to be compromised, this is unlikely to be related to the warning about SSH.

  • Please check added details about rkhunter log. Actually we not did anything in that mean time. That's why...
    – Kumar
    Sep 25, 2013 at 10:58
  • @ This is additional thing I got in log, Warning: File '/usr/bin/chattr' has the immutable-bit set. Didn't have this in previous log in 21-Sep-2013 (04:20).
    – Kumar
    Sep 25, 2013 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.