Questions related to the rootkit-detection system `rkhunter`

learn more… | top users | synonyms

0
votes
3answers
111 views

Run rkhunter regularely on a desktop system

I want to get a warning on my desktop when rkhunter finds something odd on my system. I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore. Now I want to ...
0
votes
0answers
24 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
121 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
1
vote
1answer
45 views

Should I be worried about these scan results form rkhunter?

Should I be worried about these scan results form rkhunter? [22:09:40] Info: Starting test name 'passwd_changes' [22:09:40] Checking for passwd file changes [ Warning ] [22:09:40] ...
3
votes
1answer
399 views

Found a hidden port . . . what now?

I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
0
votes
2answers
143 views

rkhunter sends no email

rkhunter sends no email I installed rkhunter on a Ubuntu 12.04.3 server sudo apt-get install rkhunter it installed the 1.3.8 version of rkhunter sudo apt-show-versions rkhunter rkhunter/precise ...
5
votes
5answers
7k views

cron.daily jobs not running

I created 3 daily cron jobs to run. Below are the three that are placed in etc/cron.daily rkhunter.sh #!/bin/sh ( rkhunter --versioncheck rkhunter --update rkhunter --cronjob --report-warnings-only ...
1
vote
1answer
1k views

eth0: PACKET SNIFFER(/sbin/dhclient

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
8
votes
2answers
2k views

rkhunter: right way to handle warnings further?

I googled some and checked out two first links it found: http://www.skullbox.net/rkhunter.php http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/ They don't mention ...
1
vote
2answers
186 views

.passw hidden files in /etc

Rkhunter reported me that it found hidden files in /etc: Warning: Hidden file found: /etc/.group.48239632746: ASCII text Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text Warning: ...
4
votes
1answer
728 views

Whitelisting ports for detection in rkhunter

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
8
votes
1answer
9k views

rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits. rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...