Questions related to the rootkit-detection system `rkhunter`

learn more… | top users | synonyms

1
vote
1answer
31 views

Backdoor.Linux.Gafgyt.A - How to detect an infection with this backdoor.

Yesterday I found out about the existence of the Backdoor.Linux.Gafgyt.A trojan backdoor. I did run chkrootkit vs 0.49 and rkhunter 1.40. But surprisingly in the logs, I could not see these programs ...
2
votes
1answer
38 views

How to enable unhide in rkhunter

I have installed rkhunter with: sudo apt-get install rkhunter And even though I have enabled all test, when I run: sudo rkhunter --check --sk If I check in the log file, I see this about the ...
0
votes
0answers
33 views

postfix installed on Ubuntu 14.04 but

rkhunter sent me a few warnings about user postfix being added to passwd file and a postfix and a postdrop group having been created. I understand from searching around with google that this is ...
2
votes
1answer
37 views

Why rkhunter skips empty and missing log file scans?

I have noticed that when scanning my machine with: sudo rkhunter --checkall --sk That part of the output in the log file is: [21:50:51] Checking for missing log files [ Skipped ...
0
votes
2answers
62 views

How to get rkhunter to skip “[Press <ENTER> to continue]”

Every time that I scan my machine with rkhunter using the following command: sudo rkhunter --checkall After it has finished with a certain type of check it asks me: [Press <ENTER> to ...
0
votes
0answers
32 views

rkhunter remove common warnings

I read here that you can exclude common rkhunter warnings by removing the # from these lines in the rkhunter.conf file: #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.static ...
1
vote
1answer
19 views

Should I uncomment out the code referring to unhide.rb (as I am using unhide.rb)?

I am using rkhunter 1.4.2, on Ubuntu 14.10, and I am also using the suggested package unhide.rb with it, so should I uncomment out this setting referring to it in the rkhunter.conf file?: ...
0
votes
1answer
18 views

APT_AUTOGEN setting just affecting the package being installed or all?

I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
1
vote
1answer
173 views

rkhunter psswd and group file changes warning

Today I did a scan of my machine with rkhunter: sudo rkhunter --checkall And these were the warnings that I got: Checking for passwd file changes [ Warning ] Checking for ...
1
vote
0answers
14 views

How to manually update RKHUNTER with newly found rootkits?

How to manually update RKHUNTER with newly found rootkits? For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit. How to manually update it's database. Simple rkhunter ...
2
votes
1answer
253 views

rkhunter checking for hidden ports skipped

I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command: sudo rkhunter --checkall I get this output about half way through: Performing ...
3
votes
1answer
466 views

How to upgrade rkhunter

When running the command: sudo rkhunter --versioncheck I get the following output: [ Rootkit Hunter version 1.4.0 ] Checking rkhunter version... This version : 1.4.0 Latest version: 1.4.2 ...
0
votes
1answer
118 views

Rootkit detector: rkhunter auto database update options

In the rkhunter config file here /etc/default/rkhunter it says: # Defaults for rkhunter automatic tasks # sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter # # This is a POSIX shell ...
2
votes
1answer
283 views

Help, I May Have a Rootkit

It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a ...
0
votes
3answers
314 views

Run rkhunter regularely on a desktop system

I want to get a warning on my desktop when rkhunter finds something odd on my system. I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore. Now I want to ...
0
votes
0answers
64 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
288 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
1
vote
1answer
99 views

Should I be worried about these scan results form rkhunter?

Should I be worried about these scan results form rkhunter? [22:09:40] Info: Starting test name 'passwd_changes' [22:09:40] Checking for passwd file changes [ Warning ] [22:09:40] ...
3
votes
1answer
656 views

Found a hidden port . . . what now?

I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
0
votes
2answers
183 views

rkhunter sends no email

rkhunter sends no email I installed rkhunter on a Ubuntu 12.04.3 server sudo apt-get install rkhunter it installed the 1.3.8 version of rkhunter sudo apt-show-versions rkhunter rkhunter/precise ...
6
votes
5answers
11k views

cron.daily jobs not running

I created 3 daily cron jobs to run. Below are the three that are placed in etc/cron.daily rkhunter.sh #!/bin/sh ( rkhunter --versioncheck rkhunter --update rkhunter --cronjob --report-warnings-only ...
1
vote
1answer
2k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
8
votes
2answers
3k views

rkhunter: right way to handle warnings further?

I googled some and checked out two first links it found: http://www.skullbox.net/rkhunter.php http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/ They don't mention ...
1
vote
2answers
192 views

.passw hidden files in /etc

Rkhunter reported me that it found hidden files in /etc: Warning: Hidden file found: /etc/.group.48239632746: ASCII text Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text Warning: ...
4
votes
1answer
949 views

Whitelisting ports for detection in rkhunter

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
9
votes
1answer
10k views

rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits. rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...