Focus on Linux
understanding chkrootkit and rkhunter logs May 08 2007 09:56AM
acattelan gmail com (4 replies)
Re: understanding chkrootkit and rkhunter logs May 09 2007 04:17PM
Clinton E. Troutman (clint troutman sbcglobal net)
On Tuesday 08 May 2007, acattelan (at) gmail (dot) com [email concealed] wrote:
> Hi,
> I'm sorry for asking a totally newbie question but I haven't found an
> answer to this. I'm really curious and concerned about what is reported
> by the chkrootkit and rkhunter on my Debian Etch home server.
>
> Here's what I get when I run them:
>
> CHKROOTKIT:
>
> Searching for suspicious files and dirs, it may take a while...
> /usr/lib/xulrunner/.autoreg
> /lib/init/rw/.ramfs
>
> Checking `sniffer'... lo: not promisc and no packet sniffer sockets
> eth0: PACKET SNIFFER(/sbin/dhclient[2181])
>
> In the system mail I also get this:
>
> /etc/cron.daily/chkrootkit:
> The following suspicious files and directories were found:
> /usr/lib/xulrunner/.autoreg
> /lib/init/rw/.ramfs
>
> eth0: PACKET SNIFFER(/sbin/dhclient[2136])
>
> RKHUNTER reports this:
>
> * Filesystem checks
> Checking /dev for suspicious files... [ OK ]
> Scanning for hidden files... [ Warning!
> ] ---------------
> /etc/.pwd.lock /dev/.static
> /dev/.udev
> /dev/.initramfs
> /dev/.initramfs-tools
> ---------------
> Please inspect: /dev/.static (directory) /dev/.udev (directory)
> /dev/.initramfs (directory)
>
> Is this something to be worried about? How can I investigate further into
> these two issues?
>
> Thanks,
> Ale.

On initial installation of both chkrootkit and rkhunter, I received many of
the same type messages.

My understanding is that since these softwares are intended for general
Linux installation, the software cannot be configured specifically for any
installation "out of the box"; some tuning is necessary through adjustment
of configuration files.

Each warning bears investigation (you will also learn about your system in
this investigation). Once you have determined a particular warning is not a
threat/problem, adjust your configuration files accordingly.

I will also say the database for rkhunter seems to have some issues. In my
case, there is a particular daily warning:
/usr/bin/wget  [ BAD ]
that I cannot get rid of no matter what I do...
Point is, you may not rid yourself of all warnings; or, if your lucky, you
might...

HTH,
--
Clinton E. Troutman
CeTro
Independent Computer Consultant for Home,
Home Office, and Small Business in Fort Worth, Texas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQBGQfQ3Ua6vNTKZkk8RAqQFAKCGqMwLoumwd7hGjea5zH7p1O1JPACeNfRv
3uDawAKOfZqRvQkHJQwUiOA=
=7oxA
-----END PGP SIGNATURE-----

[ reply ]
Re: understanding chkrootkit and rkhunter logs May 09 2007 07:19AM
Oren Held (oren held org il)
Re: understanding chkrootkit and rkhunter logs May 09 2007 06:57AM
Juergen Repolusk (juergen repolusk inso tuwien ac at)
Re: understanding chkrootkit and rkhunter logs May 08 2007 05:12PM
SZTANYIK Bence Tamas (bence infsec hu)


 

Privacy Statement
Copyright 2010, SecurityFocus