Sida 1 av 1

Frågor pga rkhunter.log

Postat: 21 mar 2010, 22:02
av advyn
Jag körde rkhunter och fick fram dessa grejjer i loggen,
[20:48:08] Info: Found file '/usr/bin/ldd': it is whitelisted for the 'script replacement' check.
[20:48:17] Info: Found file '/usr/bin/lwp-request': it is whitelisted for the 'script replacement' check.
[20:48:22] Info: Found file '/usr/sbin/adduser': it is whitelisted for the 'script replacement' check.
[20:48:26] Warning: The file '/usr/sbin/unhide' exists on the system, but it is not present in the rkhunter.dat file.
[20:48:27] Warning: The file '/usr/sbin/unhide-linux26' exists on the system, but it is not present in the rkhunter.dat file.
[20:50:39] Performing system boot checks
[20:50:39] Info: Starting test name 'startup_files'
[20:50:39] Checking for local host name [ Found ]
[20:50:39] Info: Starting test name 'startup_malware'
[20:50:39] Checking for system startup files [ Found ]
[20:50:42] Checking system startup files for malware [ None found ]
[20:50:42]
[20:50:42] Performing group and account checks
[20:50:42] Info: Starting test name 'group_accounts'
[20:50:42] Checking for passwd file [ Found ]
[20:50:42] Info: Found password file: /etc/passwd
[20:50:42] Checking for root equivalent (UID 0) accounts [ None found ]
[20:50:42] Info: Found shadow file: /etc/shadow
[20:50:42] Checking for passwordless accounts [ None found ]
[20:50:42] Info: Starting test name 'passwd_changes'
[20:50:42] Checking for passwd file changes [ None found ]
[20:50:42] Info: Starting test name 'group_changes'
[20:50:42] Checking for group file changes [ None found ]
[20:50:42] Checking root account shell history files [ OK ]
[20:50:43]
[20:50:43] Performing system configuration file checks
[20:50:43] Info: Starting test name 'system_configs'
[20:50:43] Checking for SSH configuration file [ Not found ]
[20:50:43] Checking for running syslog daemon [ Found ]
[20:50:43] Checking for syslog configuration file [ Found ]
[20:50:43] Info: Found syslog configuration file: /etc/syslog.conf
[20:50:43] Checking if syslog remote logging is allowed [ Not allowed ]
[20:50:43]
[20:50:43] Performing filesystem checks
[20:50:43] Info: Starting test name 'filesystem'
[20:50:43] Info: SCAN_MODE_DEV set to 'THOROUGH'
[20:50:44] Checking /dev for suspicious file types [ Warning ]
[20:50:44] Warning: Suspicious file types found in /dev:
[20:50:44] /dev/shm/pulse-shm-3648311577: data
[20:50:44] /dev/shm/pulse-shm-4259845016: data
[20:50:44] /dev/shm/pulse-shm-2851694753: data
[20:50:44] /dev/shm/pulse-shm-1677299384: data
[20:50:45] /dev/shm/pulse-shm-188182408: data
[20:50:45] /dev/shm/pulse-shm-559511693: data
[20:50:45] /dev/shm/pulse-shm-1828084571: data
[20:50:45] Checking for hidden files and directories [ Warning ]
[20:50:46] Warning: Hidden directory found: /etc/.java
[20:50:46] Warning: Hidden directory found: /dev/.udev
[20:50:46] Warning: Hidden directory found: /dev/.initramfs
[20:50:55] System checks summary
[20:50:55] =====================
[20:50:55]
[20:50:55] File properties checks...
[20:50:55] Files checked: 129
[20:50:55] Suspect files: 2
[20:50:55]
[20:50:55] Rootkit checks...
[20:50:55] Rootkits checked : 114
[20:50:55] Possible rootkits: 0
[20:50:55]
[20:50:55] Applications checks...
[20:50:55] Applications checked: 2
[20:50:55] Suspect applications: 0
[20:50:55]
[20:50:55] The system checks took: 3 minutes and 6 seconds
[20:50:56]
[20:50:56] Info: End date is sön 21 mar 2010 20.50.55 CET
Är det nått skumt med dom grejjer som den hittat (jag utelämnade allt som bara var ok). I sådana fall, vad ska jag göra åt det?

Re: Frågor pga rkhunter.log

Postat: 21 mar 2010, 23:00
av Ulsak
precis som med alla virusprogram med självaktning förekommer ett antal falska alarm på ett antal filer som är helt ok.
Det hände mig också...
Har du läst igenom manualen om det finns nån regler om sk policies..?

Re: Frågor pga rkhunter.log

Postat: 22 mar 2010, 15:10
av advyn
Nej, jag har bara laddat ner det och installerat det och kört det för att kolla om min dator var hackad eller nått.

Re: Frågor pga rkhunter.log

Postat: 22 mar 2010, 17:39
av Ulsak

Kod: Markera allt

[20:50:46] Warning: Hidden directory found: /etc/.java
[20:50:46] Warning: Hidden directory found: /dev/.udev
[20:50:46] Warning: Hidden directory found: /dev/.initramfs
dessa filer t ex är ju standard att de är dolda i systemet.