Rootkit Hunter

Hi,
anyone running the 1.3.4 tarball 
http://rkhunter.sourceforge.net/rkhunter-CVS.tar.gz on Debian Etch,
all running smoothly?
Karl

Karl-L. Rumpf
T. 658 986 949
Málaga, Spain
klrumpf@...
 http://www.outsourceitforless.com
----- Original Message ----- 
From: <unspawn@...>
To: <rkhunter-users@...>; <mic@...>
Sent: Thursday, August 28, 2008 8:54 AM
Subject: Re: [Rkhunter-users] US-CERT: Active attacks using stolen SSH 
keys(Phalanx2 rootkit)


> On Thu, 28 Aug 2008 03:27:39 +0200 Michael Mansour
> <mic@...> wrote:
>>Is it possible, being that active attacks are happening, the
>>current CVS snapshot could become a 1.3.3 release?
>>
>>On our production servers (and servers for clients we manage) we
>>have a policy to only install (stable) package releases to sustain
> the stability
>>of our environments.
>
> A 1.3.4 release (even number is stable)? Yes, it's possible. While
> we're working on adding more features and LKM's, most things are
> added already for a next release. I should point out that RKH CVS
> *is* stable at this point: -devel just didn't agree on a freeze
> yet. All that is required next is for users to "bless" the release
> by testing the CVS tarball RSN, so please do.
>
>
> Best regards, unSpawn
> ---
>
> --
> Learn how to build web sites.  Find a web design school near you.
> http://tagline.hushmail.com/fc/Ioyw6h4fMuen0PaBlxBgweIXS9BCRvKodq51eAwdqHMcsKXX1GTfm4/
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's 
> challenge
> Build the coolest Linux based applications with Moblin SDK & win great 
> prizes
> Grand prize is a trip for two to an Open Source event anywhere in the 
> world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Rkhunter-users mailing list
> Rkhunter-users@...
> https://lists.sourceforge.net/lists/listinfo/rkhunter-users

On Thu, 28 Aug 2008 08:54:56 +0200, unspawn@... wrote about Re:
[Rkhunter-users] US-CERT: Active attacks using stolen SSH keys (Phalanx2
rootkit):

>I should point out that RKH CVS 
>*is* stable at this point: -devel just didn't agree on a freeze 
>yet. All that is required next is for users to "bless" the release 
>by testing the CVS tarball RSN, so please do.

Tried today's cvs of rkh 1.3.3. and works very well on Mandriva Linux
Cooker.

Cheers,
=Dick Gevers=

Hi,

> Hello all,
> 
> For those that didn't pick this up already, US-CERT reported 
> yesterday:
> "US-CERT is aware of active attacks against linux-based computing 
> infrastructures using compromised SSH keys. The attack appears to 
> initially use stolen SSH keys to gain access to a system, and then 
> uses local kernel exploits to gain root access. Once root access 
> has been obtained, a rootkit known as "phalanx2" is installed." 
> Full text is at http://www.us-
> cert.gov/current/archive/2008/08/26/archive.html#ssh_key_based_attac
> ks

Thanks for this notification.

> We added Phalanx to Rootkit Hunter (RKH) back in 2006, RKH does 
> /dev/shm checks for some time now and utilises 'unhide' where 
> possible for hidden process checks. Today RKH CVS sees Phalanx2 
> added Rootkit files and directories, cd'ing into directories and 
> Inode tests. Please see the updated RKH CVS tarball at 
> http://rkhunter.sourceforge.net/rkhunter-CVS.tar.gz

Is it possible, being that active attacks are happening, the current CVS
snapshot could become a 1.3.3 release?

On our production servers (and servers for clients we manage) we have a policy
to only install (stable) package releases to sustain the stability of our
environments.

Thanks.

Michael.

> Regards, the RKH dev team
> ---
> 
> --
> Click now to find the best computer mouse for your needs!
>
http://tagline.hushmail.com/fc/Ioyw6h4evek2apuUjT9WJCKXXxP1JFWAqF5m1DwQ4TlJSweX3vdJFO/
> 
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win 
> great prizes Grand prize is a trip for two to an Open Source event 
> anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Rkhunter-users mailing list
> Rkhunter-users@...
> https://lists.sourceforge.net/lists/listinfo/rkhunter-users
------- End of Original Message -------

Sam Kuper wrote:

> Q1) The advice page for this mailing list states, "If you are not  
> running the latest version: please check the website for the latest  
> version and upgrade first." I use Debian 4 (Etch), which is the  
> latest stable Debian release. Like most users of Debian stable, I  
> upgrade by using "apt-get update; apt-get upgrade". Doing this gives  
> me rkhunter 1.2.9, whereas running "rkhunter --versioncheck" reveals  
> that the latest release of rkhunter is 1.3.2. I do not want to use  
> "testing" Debian packages on my server, as I am concerned about  
> stability. Yet rkhunter 1.2.9 is giving me some problems. My  
> question is, then: can I expect support from this mailing list for  
> rkhunter 1.2.9 or must I look elsewhere?

rkhunter 1.2.9 is not supported anymore. Contact Debian's package  
maintainer if you have problems with this old version.

> Q2) The advice page for this mailing list states, "Hashupd is on our  
> download page. Please see the FAQ for details." Actually, it isn't,  
> and yes, I have checked the online FAQ for an up-to-date link to the  
> download page, in case I was looking in the wrong place. So, please  
> could you tell me where I can obtain Hashupd?

hashupd was a script for rkhunter 1.2.9. The rkhunter 1.2.9 files are  
no longer available on the project page, so that's probably why  
hashupd is also no longer there. The FAQ should be updated, yes.

> C1) rkhunter seems to have three web sites, which is pretty  
> confusing for new users, especially as linkage between them is  
> haphazard. I, for one, would be very grateful if someone with logins  
> to those sites could perform a bit of rationalisation/simplification/ 
> de-duplication/etc.

There are only two (sourceforge.net/project/rkhunter is the file  
download section of rkhunter.sourceforge.net) and I believe the  
original rkhunter site on rootkit.nl was never taken down by the  
original author, but they have also not replied to messages about this  
issue. There is nobody on this list that fix this AFAIK.

Nils Breunese.

2008/8/25 Nils Breunese (Lemonbit) <nils@...>

> rkhunter 1.2.9 is not supported anymore. Contact Debian's package
> maintainer if you have problems with this old version.

Will do; thanks for the clarification.


> hashupd was a script for rkhunter 1.2.9. The rkhunter 1.2.9 files are
> no longer available on the project page, so that's probably why
> hashupd is also no longer there.

I suspected as much. Given which, ...


> The FAQ should be updated, yes.

Yes, that would definitely help rkhunter newbies like me!


> > C1) rkhunter seems to have three web sites, which is pretty
> > confusing for new users
> There are only two (sourceforge.net/project/rkhunter is the file
> download section of rkhunter.sourceforge.net)

Point taken. However, the look and feel of those two are so different that
they really seem to be two different sites, but both within the sourceforge
domain and linking to each other. It's still somewhat confusing! Sorry to
complain, I know these things are a pain to maintain. My hope would be that
unifying the appearance might lead to less confusion and fewer newbie
hassles.


> and I believe the
> original rkhunter site on rootkit.nl was never taken down by the
> original author, but they have also not replied to messages about this
> issue. There is nobody on this list that fix this AFAIK.

Thanks for the clarification on this point too!

Sam

Sam Kuper wrote:

>> The FAQ should be updated, yes.
> Yes, that would definitely help rkhunter newbies like me!

Only the rkhunter maintainers can do this, so we'll just have to wait  
for them to fix it. Also the front page seems to indicate 1.3.0 is the  
current version, but it's 1.3.2 AFAIK.

>> > C1) rkhunter seems to have three web sites, which is pretty
>> > confusing for new users
>> There are only two (sourceforge.net/project/rkhunter is the file
>> download section of rkhunter.sourceforge.net)
> Point taken. However, the look and feel of those two are so  
> different that they really seem to be two different sites, but both  
> within the sourceforge domain and linking to each other. It's still  
> somewhat confusing! Sorry to complain, I know these things are a  
> pain to maintain. My hope would be that unifying the appearance  
> might lead to less confusion and fewer newbie hassles.

All SourceForge projects have this. I don't think you can style the  
project's downloads page on SourceForge.

Nils Breunese.

On Mon, 25 Aug 2008 21:57:21 +0200 "Nils Breunese (Lemonbit)" 
<nils@...> wrote:
>Sam Kuper wrote:
>
>>> The FAQ should be updated, yes.
>> Yes, that would definitely help rkhunter newbies like me!
>
>Only the rkhunter maintainers can do this, so we'll just have to 
wait  
>for them to fix it.

Anyone can contribute changes. It's just a matter of posting it 
(diff against CVS  preferably) in a tracker ticket...


>Also the front page seems to indicate 1.3.0 is the  
>current version, but it's 1.3.2 AFAIK.

Just corrected it. Thanks.


best regards, unSpawn
---

--
Save on hotels.  Click here to find and compare hotel deals.
http://tagline.hushmail.com/fc/Ioyw6h4eRCk7JKAKAicjNcyyCFh8GlxdUEwOChrk2daFsgp40U1Kne/