Re: understanding chkrootkit and rkhunter logs

On Tuesday 08 May 2007, [email protected] wrote:
> Hi,
> I'm sorry for asking a totally newbie question but I haven't found an
> answer to this. I'm really curious and concerned about what is reported
> by the chkrootkit and rkhunter on my Debian Etch home server.
>
> Here's what I get when I run them:
>
> CHKROOTKIT:
>
> Searching for suspicious files and dirs, it may take a while...
> /usr/lib/xulrunner/.autoreg
> /lib/init/rw/.ramfs
>
> Checking `sniffer'... lo: not promisc and no packet sniffer sockets
> eth0: PACKET SNIFFER(/sbin/dhclient[2181])
>
> In the system mail I also get this:
>
> /etc/cron.daily/chkrootkit:
> The following suspicious files and directories were found:
> /usr/lib/xulrunner/.autoreg
> /lib/init/rw/.ramfs
>
> eth0: PACKET SNIFFER(/sbin/dhclient[2136])
>
> RKHUNTER reports this:
>
> * Filesystem checks
>    Checking /dev for suspicious files...                      [ OK ]
>    Scanning for hidden files...                               [ Warning!
> ] ---------------
> /etc/.pwd.lock /dev/.static
> /dev/.udev
> /dev/.initramfs
> /dev/.initramfs-tools
> ---------------
> Please inspect:  /dev/.static (directory)  /dev/.udev (directory) 
> /dev/.initramfs (directory)
>
> Is this something to be worried about? How can I investigate further into
> these two issues?
>
> Thanks,
> Ale.

On initial installation of both chkrootkit and rkhunter, I received many of 
the same type messages.

My understanding is that since these softwares are intended for general 
Linux installation, the software cannot be configured specifically for any 
installation "out of the box"; some tuning is necessary through adjustment 
of configuration files.

Each warning bears investigation (you will also learn about your system in 
this investigation). Once you have determined a particular warning is not a 
threat/problem, adjust your configuration files accordingly.

I will also say the database for rkhunter seems to have some issues. In my 
case, there is a particular daily warning:
    /usr/bin/wget  [ BAD ]
that I cannot get rid of no matter what I do...
Point is, you may not rid yourself of all warnings; or, if your lucky, you 
might...

HTH,
-- 
Clinton E. Troutman
CeTro
Independent Computer Consultant for Home,
  Home Office, and Small Business in Fort Worth, Texas

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQBGQfQ3Ua6vNTKZkk8RAqQFAKCGqMwLoumwd7hGjea5zH7p1O1JPACeNfRv
3uDawAKOfZqRvQkHJQwUiOA=
=7oxA
-----END PGP SIGNATURE-----