understanding chkrootkit and rkhunter logs
[email protected] 8 May 2007 09:56:10 -0000
| Newsgroups | gmane.comp.security.linux |
|---|---|
| Message-ID | <[email protected]> |
Hi, I'm sorry for asking a totally newbie question but I haven't found an answer to this. I'm really curious and concerned about what is reported by the chkrootkit and rkhunter on my Debian Etch home server. Here's what I get when I run them: CHKROOTKIT: Searching for suspicious files and dirs, it may take a while... /usr/lib/xulrunner/.autoreg /lib/init/rw/.ramfs Checking `sniffer'... lo: not promisc and no packet sniffer sockets eth0: PACKET SNIFFER(/sbin/dhclient[2181]) In the system mail I also get this: /etc/cron.daily/chkrootkit: The following suspicious files and directories were found: /usr/lib/xulrunner/.autoreg /lib/init/rw/.ramfs eth0: PACKET SNIFFER(/sbin/dhclient[2136]) RKHUNTER reports this: * Filesystem checks Checking /dev for suspicious files... [ OK ] Scanning for hidden files... [ Warning! ] --------------- /etc/.pwd.lock /dev/.static /dev/.udev /dev/.initramfs /dev/.initramfs-tools --------------- Please inspect: /dev/.static (directory) /dev/.udev (directory) /dev/.initramfs (directory) Is this something to be worried about? How can I investigate further into these two issues? Thanks, Ale.