rkhunter-users — General questions about Rootkit Hunter

[Rkhunter-users] Update RKH for CentOS

[Dimitri Y. <dyi...@fi...>]

Hello to all.

I very much appreciate that rkhunter is back on track with a dedicated=20
group of developers/maintainers. =A0Thanks so much!

When the opportunity arises, could rkhunter be updated to support the=20
latest CentOS 3 and 4 releases 3.8 and 4.4, respectively)? =A0 I=20
believe a lot of us are using this fine distro, so it would be a big=20
help.

Again, thanks.

Diggy

--=20
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: [Rkhunter-users] Update rkh for CentOS

[John H. <joh...@pl...>]

On Tue, 2006-10-03 at 13:17 -0400, Dimitri Yioulos wrote:
>
> When the opportunity arises, could rkhunter be updated to support the 
> latest CentOS 3 and 4 releases 3.8 and 4.4, respectively)?   I 
> believe a lot of us are using this fine distro, so it would be a big 
> help.
> 
4.4 is already supported.

For 3.8 could you raise this as a support request on the sourceforge web
site (http://sourceforge.net/projects/rkhunter). Then download the
hashupd.sh script (again from sourceforge), and run the program. Once
that has been done could you then attach to the support request a copy
of your os.dat and defaulthashes.dat files.



Thanks,

John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

[Rkhunter-users] Update rkh for CentOS

[Dimitri Y. <dyi...@fi...>]

Hello to all.

I very much appreciate that rkhunter is back on track with a dedicated 
group of developers/maintainers.  Thanks so much!

When the opportunity arises, could rkhunter be updated to support the 
latest CentOS 3 and 4 releases 3.8 and 4.4, respectively)?   I 
believe a lot of us are using this fine distro, so it would be a big 
help.

Again, thanks.

Diggy

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: [Rkhunter-users] A possible bug in rkhunter syslog-ng remote logging detection

[Janne P. <ja...@mi...>]

On Tue, 2006-10-03 at 15:05 +0200, unspawn wrote:
> On Tue, 3 Oct 2006, Janne Pikkarainen wrote:
> 
> > On Tuesday 03 October 2006 15:44, you wrote:
> >> This could be "better" though when testing on your sample:
> >> egrep "^[^#].*(udp|tcp)\(" /etc/syslog-ng/syslog-ng.conf
> >
> > Yes, but that would be very unreliable
> 
> OK. Could you do me a favour? Could you (make and) attach a config (make 
> it a difficult one if you can) I can test with before I decide to use the 
> Chimera?
> 
> Thanks in advance!

Okay, here comes. I don't if this is a difficult one, but you may of
course of course modify it to suit your testing needs. Hopefully my
attachment comes along just fine.

Have a nice day,

Jaba

Re: [Rkhunter-users] A possible bug in rkhunter syslog-ng remote logging detection

[Janne P. <ja...@mi...>]

On Tuesday 03 October 2006 15:44, you wrote:
> On Tue, 3 Oct 2006, Janne Pikkarainen wrote:
> > Yes, it works perfectly well!
>
> Great.
>
> This could be "better" though when testing on your sample:
> egrep "^[^#].*(udp|tcp)\(" /etc/syslog-ng/syslog-ng.conf

Yes, but that would be very unreliable:

- a single space between udp/tcp and host address is enough to break that 
regexp.

- no multiline/indentation support.

- a very greedy one: if someone has a source/filter/destination with tcp/udp 
in its name, a false positive could be returned.

- a comment line with some whitespace and # after those would not match.

So if possible, better to stick with your previous Chimera. :-)


Cheers, 

Jaba

Re: [Rkhunter-users] A possible bug in rkhunter syslog-ng remote logging detection

[Janne P. <ja...@mi...>]

On Tuesday 03 October 2006 15:23, you wrote:
> > Now that you mentioned it - syslog-ng configuration file can be indented
> > and formatted at will
>
> This Chimera could work then:
> egrep -nA1 "^dest.*{" /etc/syslog-ng/syslog-ng.conf | while read d n c; do
>   case "$c" in *udp*|*tcp*) echo $c;;
>    *) case "$d" in [0-9]-) case "$n" in
>                             udp*|tcp*) echo $n;;
>                            esac;;
>       esac;;
>   esac
> done

Yes, it works perfectly well! For me it returns

---
{ udp("my.log.host"); };
---

Thank you very much!


Best regards,

Janne Pikkarainen

Re: [Rkhunter-users] A possible bug in rkhunter syslog-ng remote logging detection

[Janne P. <ja...@mi...>]

On Tuesday 03 October 2006 14:14, you wrote:
> Hello Janne,
>
> On Tue, 3 Oct 2006, Janne Pikkarainen wrote:
> > I just ran rkhunter (v1.2.8) and noticed this:
>
> Uh. Please upgrade to 1.2.9, out since 2006/09/30 and re-release available
> since 2006/10/02.

Oh, ok. I emerged rkhunter from Gentoo Portage and also checked out rootkit.nl 
downloads page, which only had 1.2.8, so I assumed it was the latest version.  
I just learned that rkhunter lives nowadays in rkhunter.sf.net. Ah well. :-)

> I added this to the SF tracker as "1569896 Syslog-NG remote logging
> detection" and update it in CVS. Does this regex:
> logtoremote=`grep "^destination.*{.[ut].*(" /etc/syslog-ng/syslog-ng.conf`
> work, or am I missing something?

Your regexp seems to be a bit greedy and returns both a false positive and the 
correct result for me:

---
jaba@jaba ~ % grep "^destination.*{.[ut].*(" /etc/syslog-ng/syslog-ng.conf
destination console { usertty("root"); };
destination myloghost { udp("my.log.server"); };
---

If you're willing to use egrep, then this might be better:

---
egrep "^destination.*{.(udp|tcp).*\(" /etc/syslog-ng/syslog-ng.conf
---

> Any formatting or other issues we should be aware off?

Now that you mentioned it - syslog-ng configuration file can be indented and 
formatted at will, so someone might have lines like

---
destination someloghost {
         udp("some.log.server");
};
---

... which of course is a bit pain to catch, too. 


Best regards,

Janne Pikkarainen

[Rkhunter-users] A possible bug in rkhunter syslog-ng remote logging detection

[Janne P. <ja...@mi...>]

Hello all,

I just ran rkhunter (v1.2.8) and noticed this:

---
Checking for logging to remote system...                   [ OK (no remote 
logging) ]
---

"What...? I sure have a remote logging in use", I mumbled. A quick peek to 
rkhunter code revealed that this line

---
logtoremote=`cat /etc/syslog-ng/syslog-ng.conf | grep "@" | grep -v "#"`
---

has an error in it. Instead it should be for example

---
logtoremote=`egrep "^destination.*(ud|
tc)p\(\"[^\"]+\"\)" /etc/syslog-ng/syslog-ng.conf`
---

That's because syslog-ng remote logging is defined like this:

---
destination someloghost { udp("some.loghost.address"); };
---


Cheers,

Janne Pikkarainen

Re: [Rkhunter-users] White colour and blank lines

[John H. <joh...@pl...>]

On Mon, 2006-10-02 at 12:19 +0200, unspawn wrote:
> On Mon, 2 Oct 2006, John Horne wrote:
> 
> > On Mon, 2006-10-02 at 00:32 +0200, unspawn wrote:
> >> On Sun, 1 Oct 2006, John Horne wrote:
> > It works on the local PC (under KDE). However, if I SSH connect to a
> > server, I still have black characters on a white background. It doesn't
> > work when connecting through to another system.
> 
> Hmm. Did you embed that tput line in RKH, or did you run RKH after 
> manually executing those commands?
> 
No, I embedded them just before the first application scan statement.

Running this on a Solaris system did nothing, although the tput command
does exist.
Running it on a Fedora Core 4 system, changed the background to black,
but as soon as the first statement was shown it appeared as black
characters with a white background behind the text (the rest of the
screen was still a black background). Then as soon as the screen started
to scroll up it went back to black characters with a white background.

To keep it black would probably mean a bit of an overhaul of all the
output statements.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Re: [Rkhunter-users] White colour and blank lines

[John H. <joh...@pl...>]

On Mon, 2006-10-02 at 00:32 +0200, unspawn wrote:
> On Sun, 1 Oct 2006, John Horne wrote:
> 
> > The third option sounds best, but may not be possible. I have no idea
> > how to do it, but could perhaps try and find out. The second option is
> > probably the easiest.
> 
> I admit the only terminal I ran RKH off was xterm-color.
> Maybe we could using tput as in "tput setab 0; tput setaf 7; clear" 
> beforehand. Does that work? I don't run KDE.
>
It works on the local PC (under KDE). However, if I SSH connect to a
server, I still have black characters on a white background. It doesn't
work when connecting through to another system.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Re: [Rkhunter-users] quick question

[Nerijus B. <ne...@us...>]

On Sun, 01 Oct 2006 23:44:07 +0200 Mihaly Zachar <zm...@ma...> wrote:

> Is this project still alive ?
> I could not get any update since may or april .. :(

Why don't you check this maillist archives?

Regards,
Nerijus

Re: [Rkhunter-users] quick question

[John H. <joh...@pl...>]

On Sun, 2006-10-01 at 23:44 +0200, Mihaly Zachar wrote:
>
> Is this project still alive ?
>
Yes, most certainly. It is, however, now 'under new management'.

> I could not get any update since may or april .. :(
> 
Version 1.2.9 was put on to sourceforge yesterday, so you may want to
grab a copy of that. (http://sourceforge.net/projects/rkhunter)



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

[Rkhunter-users] White colour and blank lines

[John H. <joh...@pl...>]

Hello,

I run rkhunter under 2 different scenarios. The first is from server
consoles, or a PC virtual terminal, which has white characters on a
black background. The second scenario though is from the desktop, I tend
to use KDE Konsole, and this has black characters on a white background.

Now the first scenario is not a problem, but when rkhunter is using
colours the second scenario causes several blank lines to appear. It
took me quite some time to realise that in fact these were white
characters on the white background - the text was invisible!
Additionally, the 'yellow' text appears as a bright yellow, in fact so
bright that it is extremely difficult to read on a white background.

I know I could use the '--nocolors' option, but it sort of defeats the
point of having colours at all then. As far as I can tell no-one else
has mentioned this problem before, so I am wondering if I am the only
person who runs rkhunter from the desktop?!

As far as I can tell there are 3 possible solutions. One is to change
the rkhunter default colours, perhaps white to grey, but I suspect that
people would complain about that. Second, is to create a command-line
option to use a second colour-set when colours are used. (Again, perhaps
grey instead of white, and blue instead of yellow.) Third, is to get
rkhunter to 'read' if the background colour is white, and if so to
automatically use different colours.

The third option sounds best, but may not be possible. I have no idea
how to do it, but could perhaps try and find out. The second option is
probably the easiest.

Anyone have any comments about this?



Thanks,

John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

[Rkhunter-users] quick question

[Mihaly Z. <zm...@ma...>]

Guys,

Is this project still alive ?
I could not get any update since may or april .. :(

Misi

[Rkhunter-users] =?GB2312?B?tPq/qreixrE=?=

[<zxc...@ya...>]

您好!

我司（广州市南雄贸易有限公司），按季度完税，每月都搁下相当数量的国

税、地税发票。为了避免过多的发票因此作废，特--优惠对外企业、厂家、

个人代理代开！如有需要的请来电话联系！


联系人：陈健生-1 3 8 2 6 4 9 7 4 7 6

公司Email：a13...@12...

Re: [Rkhunter-users] new hashes

[Nerijus B. <ne...@us...>]

On Sun, 01 Oct 2006 00:56:44 +0100 John Horne <joh...@pl...> wrote:

> > > No. From the sourceforge site, download the 'hashupd.sh' script and run
> > > that.
> > 
> > I ran rkhunter --update, but it says all mirrors I tried are out of date.
> > I assume I shouldn't use rkhunter --update for now?
> >
> ? Why did you run that?

Because it was the official way to get updates.

> If you have version 1.2.9 of rkhunter installed,
> then you will have the latest version of the program and data files.
> Download the hashupd.sh script and follow the instructions previously
> posted.

What does hashupd.sh script do? I assume it downloads latest hashes
from internet? When I ran it, it said:
[INFO] Found release: "Fedora Core release 5 (Bordeaux) (i386)"
[INFO] "Fedora Core release 5 (Bordeaux) (i386)" is seq nr 721
[INFO] updated hashes.

Ah, I found in SF hashupd release Notes:

hashupd is an unofficial, community-provided, supported hack to update RKH's defaulthashes.dat database when --update doesn't provide updates.

Please use "-m" then review and post new hashes for inclusion in RKH to the rkhunter-users mailinglist.

So as I understand hashupd.sh updated local defaulthashes.dat with
hashes of binaries on my system? If so, how should I post these updated
hashes to SF bug tracking system? Or should I use "-m" and send it to unspawn@...?

Regards,
Nerijus

[Rkhunter-users] mirror outdated skipped

[Gordon <lq...@ya...>]

Hi

Is this mirror outdated skipped message an issue?

thanks for any advice you have time to offer

cheerio

gordon

output of CLI follows:

      
[root@g g]# rkhunter --update Running updater...  Mirrorfile /usr/local/rkhunter/lib/rkhunter/db/mirrors.dat rotated Using mirror http://mirror07.mirror.rkhunter.org [DB] Mirror file                      : Mirror outdated. Skipped   Info (current version: 2006092302, version of mirror: 2006041300) [DB] MD5 hashes system binaries       : Mirror outdated. Skipped   Info (current version: 2006093000, version of mirror: 2006022800) [DB] Operating System information     : Mirror outdated. Skipped   Info (current version: 2006093000, version of mirror: 2006051200) [DB] MD5 blacklisted tools/binaries   : Up to date [DB] Known good program versions      : Up to date [DB] Known bad program versions       : Up to date




 		
---------------------------------
On Yahoo!7
  Fuel Price Watch: Find the cheapest petrol in your area

Re: [Rkhunter-users] Support for Scientific Linux

[Michael M. <mi...@np...>]

Hi John,

> On Sun, 2006-10-01 at 08:53 +1000, Michael Mansour wrote:
> >
> > I have been using rkhunter since it's inception, so it's good to see it's
> > being maintained again.
> > 
> > For at least 18 months I have been asking Michael to add support for
> > Scientific Linux (www.scientificlinux.org) which is a straight RHEL
> > derivative. I've provided him with all info he's asked for but he's never
> > added it.
> > 
> > Will you guys (the new maintainers) be open to this? as a RHEL derivative it
> > should be a no brainer.
> > 
> Sure. Probably best if you can open this as a bug (or support 
> request?) on the sourceforge site 
> (http://sourceforge.net/projects/rkhunter/), and click on 'Submit New'.
> 
> Some info we will need:
> 1) Can you download from sourceforge the 'hashupd.sh' script and run
> that. It should update your os.dat file. In the bug report can you
> include the output produced, and attach your os.dat and
> defaulthashes.dat files please.
> 2) You need to know the name of your O/S 'release' file. Typing 'ls
> -ld /etc/*release*' should indicate which name is used.
> 3) Can you include your email address, if you are submitting the bug
> anonymously.

After the 6th attempt, the submit worked. ID: 1568620

One does have to be persistent with sourceforge.

Regards,

Michael.

Re: [Rkhunter-users] grammar fix

[John H. <joh...@pl...>]

On Sun, 2006-10-01 at 01:48 +0300, Nerijus Baliunas wrote:
> Hello,
> 
> Some errors has been found while checking. Please perform a manual check on this machine
> 
> should be
> 
> Some errors have been found while checking. Please perform a manual check on this machine
> 
> i.e. has->have.
> 
Noted.


Thanks,

John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Re: [Rkhunter-users] new hashes

[John H. <joh...@pl...>]

On Sun, 2006-10-01 at 02:43 +0300, Nerijus Baliunas wrote:
> On Sun, 01 Oct 2006 00:17:24 +0100 John Horne <joh...@pl...> wrote:
> 
> > No. From the sourceforge site, download the 'hashupd.sh' script and run
> > that.
> 
> I ran rkhunter --update, but it says all mirrors I tried are out of date.
> I assume I shouldn't use rkhunter --update for now?
>
? Why did you run that? If you have version 1.2.9 of rkhunter installed,
then you will have the latest version of the program and data files.
Download the hashupd.sh script and follow the instructions previously
posted.

I should add, that after prelinking you should run hashupd.sh again, to
bring the defaulthashes.dat file in-line with the prelinked values.

I'll see about updating the README file with a bit more detail on what
to do.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Re: [Rkhunter-users] new hashes

[Nerijus B. <ne...@us...>]

On Sun, 01 Oct 2006 00:17:24 +0100 John Horne <joh...@pl...> wrote:

> No. From the sourceforge site, download the 'hashupd.sh' script and run
> that.

I ran rkhunter --update, but it says all mirrors I tried are out of date.
I assume I shouldn't use rkhunter --update for now? Will it work in
the future?

Regards,
Nerijus

Re: [Rkhunter-users] Support for Scientific Linux

[John H. <joh...@pl...>]

On Sun, 2006-10-01 at 08:53 +1000, Michael Mansour wrote:
>
> I have been using rkhunter since it's inception, so it's good to see it's
> being maintained again.
> 
> For at least 18 months I have been asking Michael to add support for
> Scientific Linux (www.scientificlinux.org) which is a straight RHEL
> derivative. I've provided him with all info he's asked for but he's never
> added it.
> 
> Will you guys (the new maintainers) be open to this? as a RHEL derivative it
> should be a no brainer.
> 
Sure. Probably best if you can open this as a bug (or support request?)
on the sourceforge site (http://sourceforge.net/projects/rkhunter/), and
click on 'Submit New'.

Some info we will need:
1) Can you download from sourceforge the 'hashupd.sh' script and run
that. It should update your os.dat file. In the bug report can you
include the output produced, and attach your os.dat and
defaulthashes.dat files please.
2) You need to know the name of your O/S 'release' file. Typing 'ls
-ld /etc/*release*' should indicate which name is used.
3) Can you include your email address, if you are submitting the bug
anonymously.



Thanks,

John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Re: [Rkhunter-users] hidden files

[John H. <joh...@pl...>]

On Sun, 2006-10-01 at 01:42 +0300, Nerijus Baliunas wrote:
>
> I see in rkhunter.conf:
> #ALLOWHIDDENDIR=/dev/.udev
> #ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
> 
> Why are these commented out by default? IMHO it is safe to uncomment
> them by default.
> 
Under your O/S may be, but what about others - FreeBSD, Solaris, AIX?
Under these those files may not exit and therefore indicate something is
suspicious.

I think it is safer if the user has to consciously configure rkhunter
for their own computers. They should know if these files/directories are
supposed to be there or not. Hence the values should be commented out by
default.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Re: [Rkhunter-users] new hashes

[John H. <joh...@pl...>]

On Sun, 2006-10-01 at 01:38 +0300, Nerijus Baliunas wrote:
> 
> rkhunter 1.2.9 finds some unknown/bad hashes on FC5 with all updates,
> should I send them here?
> 
No. From the sourceforge site, download the 'hashupd.sh' script and run
that.

If you still get 'BAD' hash entries then it is a prelinking issue. The
problem is described in the README file under section E1.

If you are running SELinux, then as root type in 'setenforce 0'.
The try running '/etc/cron.daily/prelinking'. After that try running
rkhunter again.

If you still get 'BAD' entries, then enter '/bin/rm /etc/prelink.cache'
and run /etc/cron.daily/prelink again. This may take some time. Finally
run rkhunter again. The hashes should be fine then.

Don't forget to reset SELinux by typing in 'setenforce 1' - if you
normally have it enabled.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

[Rkhunter-users] Support for Scientific Linux

[Michael M. <mi...@np...>]

Hi Guys,

I have been using rkhunter since it's inception, so it's good to see it's
being maintained again.

For at least 18 months I have been asking Michael to add support for
Scientific Linux (www.scientificlinux.org) which is a straight RHEL
derivative. I've provided him with all info he's asked for but he's never
added it.

Will you guys (the new maintainers) be open to this? as a RHEL derivative it
should be a no brainer.

Michael.