I'm unable to remove authorized_keys, tried everything, ran chkrootkit, none found, any suggestions ?!
root@sd-111:~/.ssh# id uid=0(root) gid=0(root) groups=0(root) root@sd-111:~/.ssh# ls -al total 32 drwx------ 2 root root 4096 Dec 24 14:43 . drwx------ 23 root root 12288 Dec 24 14:57 .. -rw-r--r-- 1 root root 0 Dec 23 18:59 authorized_keys -rw-r--r-- 1 root root 381 Dec 23 18:58 authorized_keys2 -rw------- 1 root root 1675 Jan 14 2015 id_rsa -rw-r--r-- 1 root root 395 Jan 14 2015 id_rsa.pub -rw-r--r-- 1 root root 666 Mar 16 2015 known_hosts root@sd-111:~/.ssh# rm -rf authorized_keys* rm: cannot remove ‘authorized_keys’: Operation not permitted rm: cannot remove ‘authorized_keys2’: Operation not permitted root@sd-111:~/.ssh# chattr -i authorized_keys* root@sd-111:~/.ssh# rm -rf authorized_keys* rm: cannot remove ‘authorized_keys’: Operation not permitted rm: cannot remove ‘authorized_keys2’: Operation not permitted
[link][14 comments]