Fedora Security :: Receiving A Rkhunter Warning On 14 Server
Jun 15, 2011
I had been receiving a rkhunter warning on my Fedora 14 server for quite some time now. Attempts to fix the error via information from Google searches have failed. I decided to have a look at bugzilla and what do you know, a fix. The warning:
Quote:
[03:29:08] Warning: The SSH and rkhunter configuration options should be the same:
Warning: The SSH and rkhunter configuration options should be the same:
The fix, according to https://bugzilla.redhat.com/show_bug.cgi?id=596775 is to change
PHP Code:
ALLOW_SSH_PROT_V1=2
to
PHP Code:
ALLOW_SSH_PROT_V1=0
I made the change and ran rkhunter again. No more error. I know everyone was wondering about this.
"SELinux is preventing /bin/mailx from append access on the file /var/lib/rkhunter/rkhcronlog.OmRFCZOynG."
I tried to fix it by "# /sbin/restorecon -v /var/lib/rkhunter/rkhcronlog.OmRFCZOynG" as suggested by SELinux but it comes back with another warning, but with a different /rkhcronlog.xxxxxxxxx...
i think its just a way of rkhunter logging issue -. attached here is the actual error message by selinux.
Just I install the rkhunter tool via apt-get install rkhunter. When I had run the rkhunter check, rkhunter comes with a warning about "GasKit Rootkit", i dont understand what it is
This server is install new last and maby 1 week old, so i don't understand why this happends.
Like Jackp27, I am reacting to a transient warning from rkhunter, indicating a possible LKM trojan, which may or may not be a false positive. Running chkrootkit and rkhunter repeatedly, including older versions running under live CDs like INSERT, indicated nothing wrong, but two runs of rkhunter running under the possibly compromised system itself did seem to suggest rkhunter thought it might have found elements of trojan code in RAM.
Like Jackp27, I can't give details right now because I do not currently have access to my logs, but I did find one webpage (can't give link because I do not currently have access to my detailed notes) suggesting that rkhunter may have thought it found a signature of the adore trojan in RAM by looking at /proc/kallsymms which is not a file I ordinary look at. I did look at it very closely yesterday, repeatedly, and it seems to be mostly empty, but occasionaly seems to contain what might be a sequence of calls to various kernel modules--- right now I only recall that some had the form ??_guest_? and that x_tables might be involved.
Can anyone give me a rough indication of what /proc/kallsymms is supposed to do, whether it should normally be empty, and when it is not, what kind of lines are supposed to show up in that "file" when I cat it? I also saw something about ?_logdrop? which may have had something to do with with rotating logs (I rebooted several times) rather than a trojan keylogger. But maybe some trojans rotate logs to try to hide their presence?
I know I am not giving enough information--- I hope to come back later with more details after I have managed to access my logs and notes, so feel free to say what kind of details would be most helpful in helping me decide whether or not this was a false positive.
i have just updated to openSuSE 11.4 [64 bit]; rkhunter is giving these Warnings :
Warning: User 'rtkit' has been added to the passwd file. Warning: User 'pulse' has been added to the passwd file. Warning: User 'statd' has been added to the passwd file. Warning: Changes found in the group file for group 'audio': User 'pulse' has been added to the group Warning: Group 'rtkit' has been added to the group file. Warning: Group 'pulse' has been added to the group file. Warning: Group 'pulse-access' has been added to the group file. Warning: Suspicious file types found in /dev: /dev/shm/initrd_exports.sh: ASCII text Warning: Hidden directory found: /dev/.sysconfig Warning: Hidden directory found: /dev/.mount
I have my own internal bind9 server, for my local domain, and I forward internal requests for public domains to OpenDNS servers. This server is not in a DMZ, but is instead behind an dynamic NAT. I do not accept queries from the public network, only responses. I understand that DNS is primarilly a UDP protocol, so it can't pass through a stateful/nat. without a firewall allow.
I've done a little reading and learned that bind9 does not run 53 <-> 53 anymore (is now >1024 <-> 53), and modified my config so it works like bind4 did, but I am concerned that this makes me less secure. additionally, I'd really rather not have a completely open 53 rule, but it seems that if I constrain 53 traffic to my known forwarders, it interfers with some of my network services like transmission. so, what firewall rules would you guys recommend for recieving forwarded DNS query responses to my server?
You should be running a firewall. I would also periodically check for rootkits with rkhunter and chkrootkit. Antivirus is usually optional, but it depends on your network ... if you have Window$ machines, do use clamav or something.Hope I'm not distorting the thread but just ran rkhunter and got a lot of red warnings, especially worrying seems:
What the best method is for checking for rootkits? I have heard that it is best not to install and run these programs on the distro itself. Would it be possible to install them on another distro/partition and then use them to check for rootkits on my main partition/distro (Ubuntu)?
I have just been checking one of my machines with rkhunter and got the following result:
Code: [17:50:08] Warning: Checking for possible rootkit strings [ Warning ] [17:50:09] Found string 'hdparm' in file '/etc/init.d/checkroot.sh'. Possible rootkit: Xzibit Rootkit [17:50:09] Found string 'hdparm' in file '/etc/init.d/bootlogd'. Possible rootkit: Xzibit Rootkit
Using a well known search engine shows that others have come across this before: [URL] I have installed the current version of rkhunter from Debian's Unstable repo,but i still have the same result as above. I now check the rkhunter wiki,which mentions the same problem: [URL]
Quote: Here is an example on my system to remove a false positive for a certain rootkit that hit hdparm.
Chkrootkit came back ok. Running ClamAV and will only add that here if it finds anything. I just neve remember seeing these before. This is in Ubuntu 10.10
I've got rkhunter installed and regularly do scans immediately before & after updates & if I get warnings about 'file property updates' after the update I use 'rkhunter --propupd' to give me a clean run.I'm about to setup a ubuntu computer for my nan, I want to enable automatic security updates so she doesn't have to do anything to keep her system secure. I was planning on running rkhunter when I go to her house (about once a month) and check the dates in the resulting rkhunter.log warnings with those in the var/log/apt/history.log to see if legitimate updates caused any rkhunter warnings. I've noticed though that the 'Current file modifiation time:' in the rkhunter.log warnings are incorrect.
My system seems to be about 15 days behind the actual date, I've now run rkhunter --propupd so I have no warnings but got this one off another forum post to show what I mean:
Current file modification time: 1283341157 (01-Sep-2010 06:39:17)
I believe that the '1283341157' is the time in some strange format and the date in brackets is what rkhunter thinks it might be in human format.
1) How to interpret the 'strange date format' (1283341157 in the line above)?
2) If there's a way of configuring the date in rkhunter so that they're correct in rkhunter.log?
3) If there's a better way of keeping her system up-to-date & secure, it's her first computer & she's 86 so I think setting up automatic security updates is the way to go, it'll be one less thing to overwhelm her!
Let's say you have a host with some kind of locally installed root kit detector/scanner.
If someone managed to get root access to that box. Wouldn't the first thing to do, before installing a root kit, be to remove any kind root kit detector?
Checking /dev for suspicious file types [ Warning ] [13:37:16] Warning: Suspicious file types found in /dev: [13:37:16] /dev/shm/pulse-shm-43136623: data
I have been running rkhunter but how do i view the /var/log/rkhunter.log? I have tried using: sudo /var/log/rkhunter.log but all i got was "Command not found?
I have a server, running Centos 5.5. It runs daily rkhunter and logwatch. From both I get a daily mail.
I have a desktop computer, running Fedora 13 (almost 14...). It runs also a daily rkhunter and logwatch. But I get ONE mail from logwatch, which contains the result of rkhunter.
On the server, I want also only mail from logwatch, containing the rkhunter results. But so far, no luck.
How can I get the rkhunter results in the logwatch mail on my Centos server?
Something really nasty happened to my Arch Linux just now and I don't know why. I was switching through Xfwm4 themes when suddenly Kate crashed and brought down X with it. I started X back up, and Xfwm got hung up, I had to switch to another VT and run "killall X". I tried replacing xfwm4 with pekwm (but still with xfce4-panel) in .xinitrc, same thing. I deleted all my Xfce config files and tried again. The mouse didn't even move. The keyboard didn't work, not even the keyboard light would come on and I couldn't switch to another VT. I was forced to use the Reset button and hope it wouldn't ruin my hard drive.
It booted up fine, I purged all xfce4-related packages just in case while still in CLI mode, and I ran "xinit /usr/bin/pekwm" and I got into a working GUI. I closed a window and X froze again! The window's close button just stayed presses after I let go of it! I killed X from another VT. So I installed and ran "rkhunter" form AUR (I wonder why they don't have it in the arch repos, it's so much better that chkrootkit) and it warned that I might have Adore Rootkit. What should I do? If it helps, I recently installed a few packages from the Arch Linux AUR, including "ooc-git", "ooc-gtksourceview-git", "libpng12", and "virtualbox_bin".
Sometimes when I try to open some chat application i get a strange warning message asking for password. The message is that /usr/libexec/mission-control is trying to gain access of the system, please provide the password. On top of the message box it shows "Unlock Keyring".
This very weird, as I am also unable to do a print-screen when this message box is up.
what this message is all about and what does the executable /usr/libexec/mission-control do?
I have installed F11 on my server bythis article! I have problem with certificatewhen I connectin from clients computers to my mail server for reciving mail! I have warning like this
I've always used SSH to get to my Linux server and decided to figure out VNC. I've got VNC installed just fine and was logged, then I click Exit on the VNC screen and all hell broke loose. So I'm left with a gray useless screen, so I though I would kill the process. Did a ps -aux | grep vnc and saw what is running Then did a vncserver -kill :1 and vncserver -kill :2 Then typed vncserver
Now I'm getting Warning: blahblahblah:1 is taken because of /tmp/.X1-lock Remove this file if there is no X server blahblahblah:1 Warning: blahblahblah:2 is taken because of /tmp/.X2-lock Remove this file if there is no X server blahblahblah:2 So per the man pages I need to go here $HOME/.vnc and kill something. So How do I get to $HOME/.vnc? Is this a hidden location? I'm thinking I need to do a kill -9 .X1-lock per the above Warning message but where is that?
I have setup a Postfix system under Ubuntu server and everything works fine but I have seen 2 mails that stayed queued deferred in my mailqueue.
They can't be send because I received this :
Other mails are going out but these two stay there. Maybe someone could guide me where to change or look for solving this problem. I have a FQDN but do not have a static IP from where I run this mailserver.
Yesterday i run a postfix everything works fine and today it hangs up. if i dial "telnet localhost 25" i get (before day i get 220 answer and ordinary hello):
Code: Trying 62.197.207.43... Connected to trons.sk. Escape character is '^]'. and nothing go far.
