Questions related to the rootkit-detection system `rkhunter`

learn more… | top users | synonyms

0
votes
0answers
60 views

RKhunter and Chkrootkit

Running rkhunter showed the following error message-"Invalid SCRIPTWHITELIST configuration option: Non-existent pathname: /usr/bin/lwp-request". A quick search showed that I could get away with it by ...
3
votes
1answer
793 views

Unable to update rkhunter

Today when I ran the command (which I run every day and all is well): sudo rkhunter --update In order to check for updates to database files I got this error every time: [ Rootkit Hunter version ...
1
vote
1answer
59 views

Backdoor.Linux.Gafgyt.A - How to detect an infection with this backdoor.

Yesterday I found out about the existence of the Backdoor.Linux.Gafgyt.A trojan backdoor. I did run chkrootkit vs 0.49 and rkhunter 1.40. But surprisingly in the logs, I could not see these programs ...
2
votes
1answer
67 views

How to enable unhide in rkhunter

I have installed rkhunter with: sudo apt-get install rkhunter And even though I have enabled all test, when I run: sudo rkhunter --check --sk If I check in the log file, I see this about the ...
0
votes
0answers
44 views

postfix installed on Ubuntu 14.04 but

rkhunter sent me a few warnings about user postfix being added to passwd file and a postfix and a postdrop group having been created. I understand from searching around with google that this is ...
2
votes
1answer
57 views

Why rkhunter skips empty and missing log file scans?

I have noticed that when scanning my machine with: sudo rkhunter --checkall --sk That part of the output in the log file is: [21:50:51] Checking for missing log files [ Skipped ...
0
votes
2answers
108 views

How to get rkhunter to skip “[Press <ENTER> to continue]”

Every time that I scan my machine with rkhunter using the following command: sudo rkhunter --checkall After it has finished with a certain type of check it asks me: [Press <ENTER> to ...
0
votes
0answers
38 views

rkhunter remove common warnings

I read here that you can exclude common rkhunter warnings by removing the # from these lines in the rkhunter.conf file: #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.static ...
1
vote
1answer
28 views

Should I uncomment out the code referring to unhide.rb (as I am using unhide.rb)?

I am using rkhunter 1.4.2, on Ubuntu 14.10, and I am also using the suggested package unhide.rb with it, so should I uncomment out this setting referring to it in the rkhunter.conf file?: ...
0
votes
1answer
19 views

APT_AUTOGEN setting just affecting the package being installed or all?

I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
1
vote
1answer
304 views

rkhunter psswd and group file changes warning

Today I did a scan of my machine with rkhunter: sudo rkhunter --checkall And these were the warnings that I got: Checking for passwd file changes [ Warning ] Checking for ...
1
vote
0answers
26 views

How to manually update RKHUNTER with newly found rootkits?

How to manually update RKHUNTER with newly found rootkits? For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit. How to manually update it's database. Simple rkhunter ...
2
votes
1answer
389 views

rkhunter checking for hidden ports skipped

I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command: sudo rkhunter --checkall I get this output about half way through: Performing ...
3
votes
1answer
907 views

How to upgrade rkhunter

When running the command: sudo rkhunter --versioncheck I get the following output: [ Rootkit Hunter version 1.4.0 ] Checking rkhunter version... This version : 1.4.0 Latest version: 1.4.2 ...
0
votes
1answer
152 views

Rootkit detector: rkhunter auto database update options

In the rkhunter config file here /etc/default/rkhunter it says: # Defaults for rkhunter automatic tasks # sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter # # This is a POSIX shell ...
2
votes
1answer
369 views

Help, I May Have a Rootkit

It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a ...
0
votes
3answers
354 views

Run rkhunter regularely on a desktop system

I want to get a warning on my desktop when rkhunter finds something odd on my system. I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore. Now I want to ...
0
votes
0answers
74 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
320 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
1
vote
1answer
113 views

Should I be worried about these scan results form rkhunter?

Should I be worried about these scan results form rkhunter? [22:09:40] Info: Starting test name 'passwd_changes' [22:09:40] Checking for passwd file changes [ Warning ] [22:09:40] ...
3
votes
1answer
708 views

Found a hidden port . . . what now?

I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
0
votes
2answers
196 views

rkhunter sends no email

rkhunter sends no email I installed rkhunter on a Ubuntu 12.04.3 server sudo apt-get install rkhunter it installed the 1.3.8 version of rkhunter sudo apt-show-versions rkhunter rkhunter/precise ...
6
votes
5answers
12k views

cron.daily jobs not running

I created 3 daily cron jobs to run. Below are the three that are placed in etc/cron.daily rkhunter.sh #!/bin/sh ( rkhunter --versioncheck rkhunter --update rkhunter --cronjob --report-warnings-only ...
1
vote
1answer
2k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
8
votes
2answers
3k views

rkhunter: right way to handle warnings further?

I googled some and checked out two first links it found: http://www.skullbox.net/rkhunter.php http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/ They don't mention ...
1
vote
2answers
193 views

.passw hidden files in /etc

Rkhunter reported me that it found hidden files in /etc: Warning: Hidden file found: /etc/.group.48239632746: ASCII text Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text Warning: ...
4
votes
1answer
1k views

Whitelisting ports for detection in rkhunter

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
9
votes
1answer
11k views

rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits. rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...