Fedora Security :: Keep Top/htop Running Rkhunter Showed Up Randomly
Aug 29, 2009I like to keep top/htop running rkhunter showed up randomly. I didn't launch this. f11, 2 day old install, fully updated.
View 2 Replies
ADVERTISEMENT
Fedora Security :: SELinux Warning On Rkhunter?
Mar 17, 2011i get this warning from selinux :
"SELinux is preventing /bin/mailx from append access on the file /var/lib/rkhunter/rkhcronlog.OmRFCZOynG."
I tried to fix it by "# /sbin/restorecon -v /var/lib/rkhunter/rkhcronlog.OmRFCZOynG" as suggested by SELinux but it comes back with another warning, but with a different /rkhcronlog.xxxxxxxxx...
i think its just a way of rkhunter logging issue -. attached here is the actual error message by selinux.
Fedora Security :: Rkhunter Error - Can't Open File
Jun 4, 2009why I can't open this file.
[root@localhost fedora]# gedit /etc/var/log/rkhunter/rkhunter.log No protocol specified (gedit:24869): Gtk-WARNING **: cannot open display: :0.0 [root@localhost fedora]# gedit /var/log/rkhunter/rkhunter.log No protocol specified
There is absolutely no reason why it can't be opened. I opened it just fine earlier and now it won't open up for inspection.
Fedora Security :: Receiving A Rkhunter Warning On 14 Server
Jun 15, 2011I had been receiving a rkhunter warning on my Fedora 14 server for quite some time now. Attempts to fix the error via information from Google searches have failed. I decided to have a look at bugzilla and what do you know, a fix. The warning:
Quote:
[03:29:08] Warning: The SSH and rkhunter configuration options should be the same:
Warning: The SSH and rkhunter configuration options should be the same:
The fix, according to https://bugzilla.redhat.com/show_bug.cgi?id=596775 is to change
PHP Code:
ALLOW_SSH_PROT_V1=2
to
PHP Code:
ALLOW_SSH_PROT_V1=0
I made the change and ran rkhunter again. No more error. I know everyone was wondering about this.
Ubuntu :: No Running Htop Entry In Unity's Launcher?
May 28, 2011htop is my preferred system monitor, but I have a problem with it in Unity: When I open htop from the Applications lens there's no entry in the launcher added for it. This means I can't add it permanently to the launcher. It may have to do with it being a terminal based program, but I was wondering if there is a way to get it permanently added to the launcher?
View 3 Replies View RelatedSecurity :: Just Ran Rkhunter And Got A Lot Of Red Warnings?
Jan 11, 2011You should be running a firewall. I would also periodically check for rootkits with rkhunter and chkrootkit. Antivirus is usually optional, but it depends on your network ... if you have Window$ machines, do use clamav or something.Hope I'm not distorting the thread but just ran rkhunter and got a lot of red warnings, especially worrying seems:
Quote:
Applications checks...
Applications checked: 4
Suspect applications: 3
Security :: Rkhunter Useful On Slackware 13.1?
Nov 28, 2010According to the rkhunter home page, rkhunter is tested on Slackware up to version 10.1. Does this mean it is not useful on Slackware 13.1?
View 2 Replies View RelatedUbuntu Security :: Best Way To Use Chkrootkit Or Rkhunter
Apr 14, 2010What the best method is for checking for rootkits? I have heard that it is best not to install and run these programs on the distro itself. Would it be possible to install them on another distro/partition and then use them to check for rootkits on my main partition/distro (Ubuntu)?
View 9 Replies View RelatedUbuntu Security :: Rkhunter Comes With A Warning?
Jul 13, 2011Just I install the rkhunter tool via apt-get install rkhunter. When I had run the rkhunter check, rkhunter comes with a warning about "GasKit Rootkit", i dont understand what it is
This server is install new last and maby 1 week old, so i don't understand why this happends.
Security :: Possible False Positive With Rkhunter
Jan 5, 2010I have just been checking one of my machines with rkhunter and got the following result:
Code:
[17:50:08] Warning: Checking for possible rootkit strings [ Warning ]
[17:50:09] Found string 'hdparm' in file '/etc/init.d/checkroot.sh'. Possible rootkit: Xzibit Rootkit
[17:50:09] Found string 'hdparm' in file '/etc/init.d/bootlogd'. Possible rootkit: Xzibit Rootkit
Using a well known search engine shows that others have come across this before: [URL] I have installed the current version of rkhunter from Debian's Unstable repo,but i still have the same result as above. I now check the rkhunter wiki,which mentions the same problem: [URL]
Quote: Here is an example on my system to remove a false positive for a certain rootkit that hit hdparm.
[Code]....
Security :: False Positive From Rkhunter?
Oct 25, 2010Is this a false positive from rkhunter?
/usr/bin/curl [ Warning ]
/usr/bin/ldd [ Warning ]
Chkrootkit came back ok. Running ClamAV and will only add that here if it finds anything. I just neve remember seeing these before. This is in Ubuntu 10.10
Security :: Rkhunter's Email With Several Warnings
Dec 23, 2010Last night I received the classic rkhunter's email with several warnings inside:
Quote:
Warning:
Warning:
Warning:
and so on..
Why rkhunter isn't able to calculate the hash of those files and compare it with the stored one?
Other strange thing: for the "good" file, the hash is often different!
For example, in the last rkhunter.log, /bin/awk is "good".
But:
Quote:
Quote:
So, if the sha1sum is different, why rkhunter tell me that awk is secure?
Ubuntu Security :: Interpret The 'dates' In Rkhunter.log?
Oct 6, 2010I've got rkhunter installed and regularly do scans immediately before & after updates & if I get warnings about 'file property updates' after the update I use 'rkhunter --propupd' to give me a clean run.I'm about to setup a ubuntu computer for my nan, I want to enable automatic security updates so she doesn't have to do anything to keep her system secure. I was planning on running rkhunter when I go to her house (about once a month) and check the dates in the resulting rkhunter.log warnings with those in the var/log/apt/history.log to see if legitimate updates caused any rkhunter warnings. I've noticed though that the 'Current file modifiation time:' in the rkhunter.log warnings are incorrect.
My system seems to be about 15 days behind the actual date, I've now run rkhunter --propupd so I have no warnings but got this one off another forum post to show what I mean:
Current file modification time: 1283341157 (01-Sep-2010 06:39:17)
I believe that the '1283341157' is the time in some strange format and the date in brackets is what rkhunter thinks it might be in human format.
1) How to interpret the 'strange date format' (1283341157 in the line above)?
2) If there's a way of configuring the date in rkhunter so that they're correct in rkhunter.log?
3) If there's a better way of keeping her system up-to-date & secure, it's her first computer & she's 86 so I think setting up automatic security updates is the way to go, it'll be one less thing to overwhelm her!
Ubuntu Security :: Warning Flagged By The 'rkhunter'
Feb 1, 2011When I scanned my Ubuntu 10.04 with rkhunter a root kit hunter toolkit, it gave following warning:
Is there something that I have to worry about.
Code:
Security :: Localhost Scans With Rkhunter And Chkrootkit?
Feb 16, 2011Let's say you have a host with some kind of locally installed root kit detector/scanner.
If someone managed to get root access to that box. Wouldn't the first thing to do, before installing a root kit, be to remove any kind root kit detector?
Security :: Rkhunter Found Suspicious Files?
Aug 10, 2010I got this warning in the log of rkhunter:Quote:
Checking /dev for suspicious file types [ Warning ]
[13:37:16] Warning: Suspicious file types found in /dev:
[13:37:16] /dev/shm/pulse-shm-43136623: data
[code]....
Ubuntu Security :: Rkhunter Suspicious Files And Folders?
Apr 1, 2010I have been running rkhunter but how do i view the /var/log/rkhunter.log? I have tried using: sudo /var/log/rkhunter.log but all i got was "Command not found?
View 6 Replies View RelatedUbuntu Security :: Rkhunter File Properties Changed?
Sep 12, 2010Rkhunter file properties changed
View 2 Replies View RelatedUbuntu Security :: Ran A Rkhunter Check And In Log Have Found Some Very Odd Reports?
Nov 8, 2010I recently ran a rkhunter check and in my log i have found some very odd (to me at least) reports.
/usr/bin/last [ Warning ]
Warning: The file properties have changed:
File: /usr/bin/last
[code]....
Security :: Centos 5.5 / Rkhunter Result In Logwatch Mail
Apr 20, 2011I have a server, running Centos 5.5. It runs daily rkhunter and logwatch. From both I get a daily mail.
I have a desktop computer, running Fedora 13 (almost 14...). It runs also a daily rkhunter and logwatch. But I get ONE mail from logwatch, which contains the result of rkhunter.
On the server, I want also only mail from logwatch, containing the rkhunter results. But so far, no luck.
How can I get the rkhunter results in the logwatch mail on my Centos server?
Security :: X Freezing, Rkhunter Warns About Adore Rootkit?
Mar 8, 2010Something really nasty happened to my Arch Linux just now and I don't know why. I was switching through Xfwm4 themes when suddenly Kate crashed and brought down X with it. I started X back up, and Xfwm got hung up, I had to switch to another VT and run "killall X". I tried replacing xfwm4 with pekwm (but still with xfce4-panel) in .xinitrc, same thing. I deleted all my Xfce config files and tried again. The mouse didn't even move. The keyboard didn't work, not even the keyboard light would come on and I couldn't switch to another VT. I was forced to use the Reset button and hope it wouldn't ruin my hard drive.
It booted up fine, I purged all xfce4-related packages just in case while still in CLI mode, and I ran "xinit /usr/bin/pekwm" and I got into a working GUI. I closed a window and X froze again! The window's close button just stayed presses after I let go of it! I killed X from another VT. So I installed and ran "rkhunter" form AUR (I wonder why they don't have it in the arch repos, it's so much better that chkrootkit) and it warned that I might have Adore Rootkit. What should I do? If it helps, I recently installed a few packages from the Arch Linux AUR, including "ooc-git", "ooc-gtksourceview-git", "libpng12", and "virtualbox_bin".
Security :: Transient Rkhunter Warning Of Sebek/adore Trojan On Desktop Debian?
Feb 22, 2011Like Jackp27, I am reacting to a transient warning from rkhunter, indicating a possible LKM trojan, which may or may not be a false positive. Running chkrootkit and rkhunter repeatedly, including older versions running under live CDs like INSERT, indicated nothing wrong, but two runs of rkhunter running under the possibly compromised system itself did seem to suggest rkhunter thought it might have found elements of trojan code in RAM.
Like Jackp27, I can't give details right now because I do not currently have access to my logs, but I did find one webpage (can't give link because I do not currently have access to my detailed notes) suggesting that rkhunter may have thought it found a signature of the adore trojan in RAM by looking at /proc/kallsymms which is not a file I ordinary look at. I did look at it very closely yesterday, repeatedly, and it seems to be mostly empty, but occasionaly seems to contain what might be a sequence of calls to various kernel modules--- right now I only recall that some had the form ??_guest_? and that x_tables might be involved.
Can anyone give me a rough indication of what /proc/kallsymms is supposed to do, whether it should normally be empty, and when it is not, what kind of lines are supposed to show up in that "file" when I cat it? I also saw something about ?_logdrop? which may have had something to do with with rotating logs (I rebooted several times) rather than a trojan keylogger. But maybe some trojans rotate logs to try to hide their presence?
I know I am not giving enough information--- I hope to come back later with more details after I have managed to access my logs and notes, so feel free to say what kind of details would be most helpful in helping me decide whether or not this was a false positive.
Ubuntu Security :: Rkhunter/ Chkrootkit And Exim4 - Installing Progs On Lucid It Comes With Exim4?
May 7, 2010When installing these progs on Lucid it comes with exim4,I noticed this in the terminal output. What has exim4 to do with rkhunter and/or chkrootkit?
View 3 Replies View RelatedUbuntu Security :: Check For Updates To The Current Version Of Rkhunter And Upgrade To A New Version?
Sep 18, 2010How do i check for updates to the current version of rkhunter and if possible upgrade to a new version?
View 2 Replies View RelatedFedora :: DVD Burnt Fine But Never Showed Up On Desktop
Oct 4, 2009Before creating a DVD of an old movie, I tried to free up some hard disk space by burning a batch of old cartoons (Betty Boop, from the '30s.) to a data DVD, and deleting the directory after making sure the burn was good. The burn went fine, and the disc ejected correctly. (This is an important point!) I immediately re-inserted it so that I could check the contents, as I've done many times before, but it never showed up on my desktop.
(F10 with Gnome) I opened Nautilus and found two copies of the DVD listed, and both context menus listed both Mount and Eject, as though Gnome wasn't sure if it was or wasn't mounted. Checking, neither shows up in /media, /mnt or /etc/mtab. At this point, I can no longer mount it or any other disc. I've tried logging out and logging in, with no change. I'd consider a reboot, but my uptime has quite literally reached Biblical proportions and I hate to waste it if I don't have to. How to tell Fedora to let go of a DVD that isn't in the drive any longer?
Fedora Installation :: F15 Upgrade - Disk Led Showed No Activity
May 30, 2011I followed the guideline 'How to use PreUpgrade' to upgrade F14 -> F15. What happened was that after reboot: 1. The screen was a mess ... no readable information 2. No reaction on pressing 'return' 3. The disk led showed no activity, so I reseted the computer after 5 minutes inactivity. The system came up but with F14. I repeated the 'preupgrade' and all messages are in [URL]... but still F14 comes up after reboot. Where have I missed ... eager to get F15
View 4 Replies View RelatedFedora :: Hotkey Doesn't Work When A Menu Is Showed Or 3d Application Is Started?
Jun 20, 2010I would like to know if there is a solution to this problem. The multimedia hotkeys (play/pause, stop, volume up/down, volume mute, ecc) stop working when i open any menu (for example mintmenu, that i use, or any menu of firefox like bookmarks) or if i start an application, such as openarena. The major problem is for volumes keys, that stop working in these cases.
Any ideas? I tried to change keyboard model, disable hotkeys mapped in prefereces->keyboard shortcut (with this they just stop working), but nothing changed.
Ubuntu Multimedia :: Firefox Crashing Randomly When Flash Running?
Jun 1, 2010I've (finally) got the 64-bit Flash driver installed and working, but now I get an illegal instruction when I run a flash operation (video, game...) at a random point while it runs. I see this in the terminal:
Code:
(firefox-bin:2108): Gdk-WARNING **: XID collision, trouble ahead
(firefox-bin:2108): Gdk-WARNING **: XID collision, trouble ahead
[code]...
Fedora Installation :: 10 - Graphic Drivers - Screen Showed Only A Bunch Of Colored Vertical Lines
Feb 10, 2009I recently downloaded and installed Fedora 11 Alpha. I then installed the Nvidia drivers for my Graphics card (GeForce 7800 GTX). I discovered that Fedora 11 is using a Beta version of Xorg and an incompatible ABI. So, my drivers would not work with Fedora 11 without me dowgrading the Xorg server. I decided to reinstall Fedora 10 instead.
I started the install, and when the installation loaded the generic video drivers, my screen showed only a bunch of colored vertical lines. Fedora 10 doesn't allow me to install in text mode.
Fedora Security :: Get A Server Up And Running With SELinux Fully Enabled?
Mar 19, 2009I decided that I'd torture myself and try to get a server up and running with SELinux fully enabled. I so far have figured out virtual hosting, vsftpd, and SSH to work with it nicely, but I can't figure out what to do to get AWstats to be viewable through a browser with SELinux enabled. This is what I get from /var/log/messages:
Code:
Mar 19 15:09:34 localhost kernel: type=1400 audit(1237496974.987:69): avc: denied { getattr } for pid=4769 comm="httpd" path="/usr/share/awstats/wwwroot/cgi-bin/awstats.pl" dev=sda1 ino=1267968 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_awstats_script_exec_t:s0 tclass=file
Mar 19 15:09:34 localhost kernel: type=1400 audit(1237496974.987:70): avc: denied { getattr } for pid=4769 comm="httpd" path="/usr/share/awstats/wwwroot/cgi-bin/awstats.pl" dev=sda1 ino=1267968 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_awstats_script_exec_t:s0 tclass=file
Could someone explain to me what I should be looking for in these messages? Or what I would need to do to fix it?
