Topic: "Warning: SSH protocol v1 has been enabled..." - what does it mean?

[judgej]

Anyone any idea what this message in the daily rkhunter e-mails means?

Is it something expected, that is not being suppressed by the rkhunter (and should be), or is it something that should not be enabled on the SME Server 7.3 in the first place?

[william_syd]

What's the output of.....

config show sshd

[judgej]

Code: [Select]

sshd=service
    MaxAuthTries=2
    PasswordAuthentication=yes
    PermitRootLogin=no
    Protocol=2,1
    TCPPort=22
    UsePAM=yes
    access=private
    status=enabled
Am I guessing correctly that it is the '1' in the '2,1'? Something that an upgrade should perhaps have removed at some point?

[william_syd]

Possibly.

7.something upraded to 7.3 gives me...

sshd=service
    MaxAuthTries=2
    PasswordAuthentication=yes
    PermitRootLogin=yes
    Protocol=2
    TCPPort=22
    UsePAM=yes
    access=public
    status=enabled


I get the same result with three instalations all in server-only mode.

If you have never messed with the Protocol value then I would deem this a bug.

[judgej]

Thanks, I'll treat it as a bug. This is a machine that has been upgraded over many versions, so may have stuff left over from earlier versions.

I've just compared four servers. The two servers that were installed with SME6.0 are both okay - they have only V2 protocol defined. The two servers that were installed initially with SME5.5 both have V1 protocol in them.

Thanks for the help - I'll get a bug raised.

[cactus]

Thanks for the help - I'll get a bug raised.

Which would be bug 3803, just as a service to future readers....

[judgej]

Yeah, thanks, I should have done that.

This issue has resulted in an update to the documentation here http://wiki.contribs.org/Log_Files#RK_Hunter_Messages (which needs some further corrections, but I've lost my wiki password again).

[cactus]

Yeah, thanks, I should have done that.

This issue has resulted in an update to the documentation here http://wiki.contribs.org/Log_Files#RK_Hunter_Messages (which needs some further corrections, but I've lost my wiki password again).

It should be the same as your forum password, if you still can not login, please file a bug (and perhaps consider downloading soemthing like Keepass to store your passwords )

[judgej]

Thanks - page now updated. I completely forgot the Wiki password was the same as the forums, which is why I thought I had 'lost' my password for the wiki - not a trace of it noted down anywhere :-O