The key you cannot delete
Thirty-six sessions on one honeypot appended an SSH key to authorized_keys and then set the immutable and append-only attributes on the file, so deleting the line fails even for root. All thirty-six planted the same public key, whose comment dates it to June 2023. Detection is one command: lsattr.
They add a key to your authorized keys file, then make it impossible to delete.
You spot the extra key, you delete the line, you move on. That is the normal cleanup.
Thirty-six sessions here did something else. First they clear the immutable and append-only attributes, in case the file already has them. Then they write their key. Then they set both attributes back.
From that point, remove fails. Not permission denied — operation not permitted. And it fails for root too.
All thirty-six planted the same public key. Its comment says it was generated in June, twenty twenty-three. The most recent one arrived this morning.
If deleting a line from that file fails, it is not a broken disk. It is a file attribute working for somebody else.
Check with lsattr. Clear it with chattr minus i a.
#linux#security#ssh#infosec#sysadmin
❯ Check with lsattr. Clear it with chattr minus i a.