On Tuesday 08 May 2007, acattelan@gmail.com wrote:
Hi,
I'm sorry for asking a totally newbie question but I haven't found an
answer to this. I'm really curious and concerned about what is reported
by the chkrootkit and rkhunter on my Debian Etch home server.
Here's what I get when I run them:
CHKROOTKIT:
Searching for suspicious files and dirs, it may take a while...
/usr/lib/xulrunner/.autoreg
/lib/init/rw/.ramfs
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/sbin/dhclient[2181])
In the system mail I also get this:
/etc/cron.daily/chkrootkit:
The following suspicious files and directories were found:
/usr/lib/xulrunner/.autoreg
/lib/init/rw/.ramfs
eth0: PACKET SNIFFER(/sbin/dhclient[2136])
RKHUNTER reports this:
* Filesystem checks
Checking /dev for suspicious files... [ OK ]
Scanning for hidden files... [ Warning!
] ---------------
/etc/.pwd.lock /dev/.static
/dev/.udev
/dev/.initramfs
/dev/.initramfs-tools
---------------
Please inspect: /dev/.static (directory) /dev/.udev (directory)
/dev/.initramfs (directory)
Is this something to be worried about? How can I investigate further into
these two issues?
Thanks,
Ale.
On initial installation of both chkrootkit and rkhunter, I received many of
the same type messages.
My understanding is that since these softwares are intended for general
Linux installation, the software cannot be configured specifically for any
installation "out of the box"; some tuning is necessary through adjustment
of configuration files.
Each warning bears investigation (you will also learn about your system in
this investigation). Once you have determined a particular warning is not a
threat/problem, adjust your configuration files accordingly.
I will also say the database for rkhunter seems to have some issues. In my
case, there is a particular daily warning:
/usr/bin/wget Â[ BAD ]
that I cannot get rid of no matter what I do...
Point is, you may not rid yourself of all warnings; or, if your lucky, you
might...
HTH,
--
Clinton E. Troutman
CeTro
Independent Computer Consultant for Home,
Home Office, and Small Business in Fort Worth, Texas
pgpdL86KT5pHW.pgp
Description: PGP signature
