root ssh authorized_keys file has been deleted and password login allowed

After a 3 week vacation just tried to login as root to my cwppro servers.

In all cases the authorized_keys file in the .ssh file has been deleted breaking the familiar connection.

Also on all servers password login was disabled by me believing this to be a more secure setting.

It looks as though the /etc/sshd/...config files were updated in order to allow password authentication.

I am assuming and really hoping that some cwp_update script made these setting changes..?..

I am reluctant to add the root authorized_keys file back until I know what is going on ?

The original root authorized_keys files for many servers was provided by the server service, now broken.

Pllease help me better understand what might have happened.

Thanks for any info, still reviewing posts for relevant info

The issue arises from how the CWP `temp_hacker_check` script handles SSH keys during its daily cleanup process: the script is poorly coded and removes SSH keys for a specific list of users—including the `operator` user, which shares the same home directory as the `root` user (`/root`).
When it deletes the contents of the `operator` user's `.ssh` directory, it inadvertently deletes the contents of `/root/.ssh` as well.
Therefore, rather than modifying the script itself, a simple and effective solution for future versions is to change the `operator` user's home directory:

Code: [Select]

# usermod -d /root/operator operator

The `operator` user is a standard user created by Linux long ago, specifically for backups. It is created with the same user ID as *root* (0) but uses an unprivileged shell; this change does not affect server operations.
I implemented this modification on my servers several days ago; it is working well, and the `root` user's SSH keys are no longer being deleted.

Avoid altering the script itself, as your changes could be overwritten in the future by new updates to the `temp_hacker_check` script.
There is no need to disable SSH; simply run the command above.
SSH is your best ally for server administration and is very secure, provided you properly protect your keys.

Best regards,
Netino