Questions related to the rootkit-detection system `rkhunter`

learn more… | top users | synonyms

2
votes
0answers
13 views

How to enable unhide in rkhunter

I have installed rkhunter with: sudo apt-get install rkhunter And even though I have enabled all test, when I run: sudo rkhunter --check --sk If I check in the log file, I see this about the ...
0
votes
0answers
21 views

postfix installed on Ubuntu 14.04 but

rkhunter sent me a few warnings about user postfix being added to passwd file and a postfix and a postdrop group having been created. I understand from searching around with google that this is ...
2
votes
1answer
27 views

Why rkhunter skips empty and missing log file scans?

I have noticed that when scanning my machine with: sudo rkhunter --checkall --sk That part of the output in the log file is: [21:50:51] Checking for missing log files [ Skipped ...
0
votes
2answers
32 views

How to get rkhunter to skip “[Press <ENTER> to continue]”

Every time that I scan my machine with rkhunter using the following command: sudo rkhunter --checkall After it has finished with a certain type of check it asks me: [Press <ENTER> to ...
0
votes
0answers
25 views

rkhunter remove common warnings

I read here that you can exclude common rkhunter warnings by removing the # from these lines in the rkhunter.conf file: #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.static ...
1
vote
1answer
13 views

Should I uncomment out the code referring to unhide.rb (as I am using unhide.rb)?

I am using rkhunter 1.4.2, on Ubuntu 14.10, and I am also using the suggested package unhide.rb with it, so should I uncomment out this setting referring to it in the rkhunter.conf file?: ...
0
votes
1answer
18 views

APT_AUTOGEN setting just affecting the package being installed or all?

I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
1
vote
1answer
94 views

rkhunter psswd and group file changes warning

Today I did a scan of my machine with rkhunter: sudo rkhunter --checkall And these were the warnings that I got: Checking for passwd file changes [ Warning ] Checking for ...
0
votes
0answers
11 views

How to manually update RKHUNTER with newly found rootkits?

How to manually update RKHUNTER with newly found rootkits? For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit. How to manually update it's database. Simple rkhunter ...
2
votes
1answer
176 views

rkhunter checking for hidden ports skipped

I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command: sudo rkhunter --checkall I get this output about half way through: Performing ...
2
votes
1answer
264 views

How to upgrade rkhunter

When running the command: sudo rkhunter --versioncheck I get the following output: [ Rootkit Hunter version 1.4.0 ] Checking rkhunter version... This version : 1.4.0 Latest version: 1.4.2 ...
0
votes
1answer
99 views

Rootkit detector: rkhunter auto database update options

In the rkhunter config file here /etc/default/rkhunter it says: # Defaults for rkhunter automatic tasks # sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter # # This is a POSIX shell ...
2
votes
1answer
222 views

Help, I May Have a Rootkit

It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a ...
0
votes
3answers
277 views

Run rkhunter regularely on a desktop system

I want to get a warning on my desktop when rkhunter finds something odd on my system. I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore. Now I want to ...
0
votes
0answers
56 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
266 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
1
vote
1answer
91 views

Should I be worried about these scan results form rkhunter?

Should I be worried about these scan results form rkhunter? [22:09:40] Info: Starting test name 'passwd_changes' [22:09:40] Checking for passwd file changes [ Warning ] [22:09:40] ...
3
votes
1answer
598 views

Found a hidden port . . . what now?

I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
0
votes
2answers
171 views

rkhunter sends no email

rkhunter sends no email I installed rkhunter on a Ubuntu 12.04.3 server sudo apt-get install rkhunter it installed the 1.3.8 version of rkhunter sudo apt-show-versions rkhunter rkhunter/precise ...
6
votes
5answers
10k views

cron.daily jobs not running

I created 3 daily cron jobs to run. Below are the three that are placed in etc/cron.daily rkhunter.sh #!/bin/sh ( rkhunter --versioncheck rkhunter --update rkhunter --cronjob --report-warnings-only ...
1
vote
1answer
2k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
8
votes
2answers
3k views

rkhunter: right way to handle warnings further?

I googled some and checked out two first links it found: http://www.skullbox.net/rkhunter.php http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/ They don't mention ...
1
vote
2answers
188 views

.passw hidden files in /etc

Rkhunter reported me that it found hidden files in /etc: Warning: Hidden file found: /etc/.group.48239632746: ASCII text Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text Warning: ...
4
votes
1answer
878 views

Whitelisting ports for detection in rkhunter

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
8
votes
1answer
10k views

rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits. rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...