rkhunter-users — General questions about Rootkit Hunter

[Rkhunter-users] Email problem after upgade

[Kent O. <fo...@ds...>]

I upgraded to the latest version of rkhunter. Now the daily emails I =
receive are sent to a different email address. Where do I change the =
email address that the daily report is sent to? I'm running Fedora 4.

Thanks

[Rkhunter-users] (no subject)

[pi <zi...@al...>]

Hi.

Running rkhunter with the latest updates on my fc4-fully updated 
system, gives me nothing unusual at all.
But in mail-log this shows up:

Date: Sun, 19 Mar 2006 11:37:42 +0100
From: root <root@tilda.localdomain>
To: root@tilda.localdomain
Subject: [rkhunter] Warnings found for tilda.localdomain

Please inspect this machine, because it can be infected

Anyone who can help? chkhrootkit doesnt show anyting unusual either.

Regards
pi

[Rkhunter-users] two problems...

[Max W. <dav...@fa...>]

After a recent update (using smartpm configured to use atrpms), I'm
running Rootkit Hunter 1.2.8 on fc4 on an x86_64 (AMD).

I've recently been getting these messages in my reports :

"
Running rkhunter updater... Thu, 16 Mar 2006 04:02:25 +0800

Mirrorfile /var/rkhunter/db/mirrors.dat rotated
Using mirror http://mirror01.mirror.rkhunter.org
[DB] Mirror file                      : ERROR
Fatal error: Problem while fetching file
Finished rkhunter updater.. Thu, 16 Mar 2006 04:02:27 +0800
Ready.
"

...

"
* Filesystem checks
   Checking /dev for suspicious files...   [ OK ]
   Scanning for hidden files...  [ Warning! ]
---------------
/dev/.udevdb  /usr/share/man/man1/..1.gz  /etc/.pwd.lock /etc/.java
---------------
Please inspect:  /dev/.udevdb (directory)  /usr/share/man/man1/..1.gz
(gzip compressed data, from Unix, max compression)  /etc/.java
(directory)
"

1) I'm not sure why the updater is failing - any ideas?

2) I inspected the files/directories and they look 'ok', but I'm not
sure. What should I be looking for?

Max.

Re: [Rkhunter-users] Bug: Solaris tests fails

[John H. <joh...@pl...>]

On Fri, 2006-02-17 at 17:18 +0100, unspawn wrote:
> 
> On Fri, 17 Feb 2006, John Horne wrote:
> > Using RKhunter 1.2.8 on Solaris 9, with the --report-warnings-only
> > option gives an error:
> >  expr: non-numeric argument
> 
> Since Ksh does have variable $SECONDS, changing line 4846
> >  if [ ${OPERATING_SYSTEM} = "AIX" ] ; then
> to read
> if [ ${OPERATING_SYSTEM} = "AIX" -o ${OPERATING_SYSTEM} = "SunOS" ]; then
> should do it, right?
> 
Yes. I have tried this and it works fine.

> 
> > This last test fails. Under Solaris 'date +%s' does nothing, ENDTIME
> > gets set to '%s', and subsequently the expr fails because '%s' is not
> > numeric.
> 
> Under Linux and BSD 'date +%s' shows seconds since start of epoch,
> how does Solaris show that?
> 
As far as I can tell it doesn't. I can see nothing in the date/strftime
man pages saying anything about a format for the seconds from the start
of epoch.


John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

[Rkhunter-users] Bug: Solaris tests fails

[John H. <joh...@pl...>]

Hello,

Using RKhunter 1.2.8 on Solaris 9, with the --report-warnings-only
option gives an error:

  expr: non-numeric argument

The problem seems to be that the code detects Solaris and switches to
using the KSH shell. It then checks (line 311):

  case `uname` in
  AIX|SunOS)
      BEGINTIME=$SECONDS

which is fine, but at the end (line 4846) it does:

  if [ ${OPERATING_SYSTEM} = "AIX" ] ; then
         ENDTIME=$SECONDS
        else
         ENDTIME=`date +%s`
  fi
  TOTALTIME=`expr ${ENDTIME} - ${BEGINTIME}`

This last test fails. Under Solaris 'date +%s' does nothing, ENDTIME
gets set to '%s', and subsequently the expr fails because '%s' is not
numeric.


Regards,

John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839

Fw: [Rkhunter-users] RkHunter reports positives after patches

[Carlito - Ps2Fantasy.c. <ca...@ps...>]

Hello unSpawn,

  thanks for the feedback.

  Unfortunately, just before we run rkhunter and got those positives we also
 had installed r-fx network "les" tool, a tool that changes the attributes 
of
 the main executables to make them available only to root. So, tripwire
 reported positives, since it checks for files attributes, on all those
 executables affected by the tool, which included those I am getting
 positives for.

 Rpm -V returns ".M......   /usr/bin/write", file mode change...

 Thanks
>
>
> ----- Original Message ----- 
> From: "unspawn" <un...@ro...>
> To: "Carlito - Ps2Fantasy.com" <ca...@ps...>
> Cc: <rkh...@li...>
> Sent: Sunday, January 29, 2006 2:51 PM
> Subject: Re: [Rkhunter-users] RkHunter reports positives after patches
>
>
>> Hello Carlito,
>>
>> On Sun, 29 Jan 2006, Carlito - Ps2Fantasy.com wrote:
>>> We have a report on one server of some positives; the machine has rh9 
>>> patched every time a new fedora legacy update comes out.
>>>
>>> These are the positives we are getting:
>>>
>>> /bin/dmesg [ BAD ]
>>> /bin/kill [ BAD ]
>>> /bin/login [ BAD ]
>>> /bin/mount [ BAD ]
>>
>> See if the util-linux rpm itself checks out fine (use "rpm -V util-linux" 
>> or with -p and RPM from mirror).
>>
>> * If you already run a filesystem integrity checker like Aide, Samhain or 
>> even tripwire (and you keep a copy of the database off-site) it would be 
>> good to check, just to be sure.
>>
>>
>> Cheers, unSpawn
>>
>>
>> -- 
>> Internal Virus Database is out-of-date.
>> Checked by AVG Free Edition.
>> Version: 7.1.371 / Virus Database: 267.14.17/227 - Release Date: 
>> 1/11/2006
>>
>>
> 

[Rkhunter-users] RkHunter reports positives after patches

[Carlito - Ps2Fantasy.c. <ca...@ps...>]

Hello all.

We have a report on one server of some positives; the machine has rh9 =
patched every time a new fedora legacy update comes out.

These are the positives we are getting:

 /bin/dmesg [ BAD ]
/bin/kill [ BAD ]
/bin/login [ BAD ]
/bin/mount [ BAD ]

What should we do?

Thanks.