2

I have installed rkhunter with:

sudo apt-get install rkhunter

And even though I have enabled all test, when I run:

sudo rkhunter --check --sk

If I check in the log file, I see this about the unhide command:

[21:21:04] Info: Starting test name 'hidden_procs'
[21:21:04] Info: Found the 'unhide' command: /usr/bin/unhide
[21:21:04] Info: The use of 'unhide' has been disabled at the users request
[21:21:04]   Checking for hidden processes                   [ None found ]

Why is this? I have enabled all tests, and not asked it to disable any, so why even though this package is installed is it telling me that it has been disabled at user request (which is not true)? And how do I enable it then? Unless there is a good reason for this to be disabled, like if it is depreciated for instance?

OS Information:

Description:    Ubuntu 15.04
Release:    15.04

Package Information:

Rkhunter:

rkhunter:
  Installed: 1.4.2-0.4
  Candidate: 1.4.2-0.4
  Version table:
 *** 1.4.2-0.4 0
        500 http://gb.archive.ubuntu.com/ubuntu/ vivid/universe amd64 Packages
        100 /var/lib/dpkg/status

unhide:

unhide:
  Installed: 20121229-1
  Candidate: 20121229-1
  Version table:
 *** 20121229-1 0
        500 http://gb.archive.ubuntu.com/ubuntu/ vivid/universe amd64 Packages
        100 /var/lib/dpkg/status
Improve this question
3
  • Ubuntu 15.04 and the same versions of rkhunter and unhide. No problems. Do you really have used sudo rkhunter --check --sk?
    – A.B.
    May 18, 2015 at 16:23
  • Have you changed the configuration /etc/rkhunter.conf?
    – A.B.
    May 18, 2015 at 16:24
  • @A.B.: Yes, I have, I even removed unhide from the disabled tests section, so it should be enabled, unless there is somewhere else I need to enable it? A different section in the config file? A different place completely?
    – user364819
    May 18, 2015 at 16:31

1 Answer 1

Reset to default
1

I have found the answer:

The author of the program (as he has done with some of the other config options) left one of the options like this:

DISABLE_UNHIDE=1

And even though above that he says:

# If both the C 'unhide', and Ruby 'unhide.rb', programs exist on the system,
# then it is possible to disable the execution of one of the programs if
# desired. By default rkhunter will look for both programs, and execute each
# of them as they are found. If the value of this option is '0', then both
# programs will be executed if they are present. A value of '1' will disable
# execution of the C 'unhide' program, and a value of '2' will disable the Ruby
# 'unhide.rb' program. To disable both programs, then disable the
# 'hidden_procs' test.
#
# The default value is '0'.
#

He has obviously forgotten, and left it as 1 meaning that the unhide test is not run. So to enable it, just simply change the option to what it is meant to be as default, this being 0.

Improve this answer

You must log in to answer this question.