Questions tagged [rkhunter]
Questions related to the rootkit-detection system `rkhunter`
60
questions
36
votes
11
answers
70k
views
cron.daily jobs not running
I created 3 daily cron jobs to run.
Below are the three that are placed in etc/cron.daily
rkhunter.sh
#!/bin/sh
(
rkhunter --versioncheck
rkhunter --update
rkhunter --cronjob --report-warnings-only
...
- 1,153
31
votes
1
answer
25k
views
rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs
I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits.
rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...
- 4,167
25
votes
1
answer
30k
views
What is the sandbox user '_apt' on my system
I ran rkhunter and found out a warning, that there is a new user called _apt on my Ubuntu 16.04
$ grep _apt /etc/passwd
_apt:x:124:65534::/nonexistent:/bin/false
All I found out is, that it seems ...
- 32.4k
12
votes
1
answer
7k
views
If I have clamav do I need to install rootkit hunter
So I have clamav the antivirus but is that a protection against rootkits or do I need to install rootkit hunter as well with clamav?
8
votes
1
answer
22k
views
How to upgrade rkhunter
When running the command:
sudo rkhunter --versioncheck
I get the following output:
[ Rootkit Hunter version 1.4.0 ]
Checking rkhunter version...
This version : 1.4.0
Latest version: 1.4.2
...
user364819
8
votes
2
answers
8k
views
rkhunter: right way to handle warnings further?
I googled some and checked out two first links it found:
http://www.skullbox.net/rkhunter.php
http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/
They don't mention what ...
- 2,403
6
votes
1
answer
13k
views
rkhunter psswd and group file changes warning
Today I did a scan of my machine with rkhunter:
sudo rkhunter --checkall
And these were the warnings that I got:
Checking for passwd file changes [ Warning ]
Checking for ...
user364819
6
votes
2
answers
4k
views
Whitelisting ports for detection in rkhunter
I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
- 74.9k
6
votes
0
answers
437
views
Rkhunter still relevant in 2022?
I tried using the RKHunter 1.4.6 (http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz) in Ubuntu20.04 , it is around 4 years old , running it did not find any ...
- 61
6
votes
0
answers
6k
views
Checking if SSH protocol v1 is allowed [closed]
I ran rkhunter -c on a server an the warning that i got was the following:
Checking if SSH protocol v1 is allowed [ Warning ]
Warning: The SSH configuration option 'Protocol' has not been set.
...
4
votes
1
answer
2k
views
Help, I May Have a Rootkit
It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a TP-...
- 1,676
3
votes
3
answers
3k
views
How to get rkhunter to skip "[Press <ENTER> to continue]"
Every time that I scan my machine with rkhunter using the following command:
sudo rkhunter --checkall
After it has finished with a certain type of check it asks me:
[Press <ENTER> to continue]...
user364819
3
votes
1
answer
14k
views
How to install rkhunter in ubuntu?
Ok I know the question sounds strange but I need help installing rkhunter the accurate way and do I need to follow all the steps in this article https://help.ubuntu.com/community/RKhunter?
user491354
3
votes
1
answer
7k
views
Unable to update rkhunter
Today when I ran the command (which I run every day and all is well):
sudo rkhunter --update
In order to check for updates to database files I got this error every time:
[ Rootkit Hunter version 1....
user364819
3
votes
2
answers
8k
views
RKhunter and Chkrootkit
Running rkhunter showed the following error message-"Invalid SCRIPTWHITELIST configuration option: Non-existent pathname: /usr/bin/lwp-request". A quick search showed that I could get away with it by "...
- 173
3
votes
1
answer
3k
views
Found a hidden port . . . what now?
I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
- 43.6k
3
votes
0
answers
420
views
How to manually update RKHUNTER with newly found rootkits?
How to manually update RKHUNTER with newly found rootkits?
For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit.
How to manually update it's database. Simple rkhunter -...
- 131
2
votes
1
answer
7k
views
eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]
Im new to Ubuntu and would like help please, I ran ProShield and got this error -
eth0: PACKET SNIFFER(/sbin/dhclient
I ran the following programs below and nothing came up as far as I can see. ...
- 21
2
votes
2
answers
7k
views
Rkhunter warnings help
I installed Ubuntu 14.04 a few days ago. I've made a scan with a RkHunter and got a few warnings that I don't really know what to do with. I read about false positives a little bit but I didn't find ...
- 21
2
votes
1
answer
1k
views
Baffling menu when installing RKHunter
Someone advised me to install a program called rkhunter for security. I've tried to do so, just using the apt command at the terminal, but am presented with a weird message about e-mail servers.
I ...
- 121
2
votes
1
answer
4k
views
rkhunter found 6 possible rootkits & how to remove them
hello i install rkhunter for first time and when i run rkhunter -c in result it came with 6 possible rootkit i wonder if these rootkits have are dangerous and if are how to remove them. ps: my pc has ...
- 21
2
votes
1
answer
6k
views
rkhunter checking for hidden ports skipped
I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command:
sudo rkhunter --checkall
I get this output about half way through:
Performing checks ...
user364819
2
votes
1
answer
2k
views
How to enable unhide in rkhunter
I have installed rkhunter with:
sudo apt-get install rkhunter
And even though I have enabled all test, when I run:
sudo rkhunter --check --sk
If I check in the log file, I see this about the ...
user364819
2
votes
1
answer
1k
views
rkhunter shows a possible rootkit or a false possitive?
When I do an rkhunter --check it shows me that I have possible rootkits:
/usr/bin/rkhunter: 14795: [: /usr/lib/firefox/firefox: unexpected operator
/usr/bin/rkhunter: 14795: [: /usr/lib/firefox/...
- 722
1
vote
1
answer
908
views
Why rkhunter skips empty and missing log file scans?
I have noticed that when scanning my machine with:
sudo rkhunter --checkall --sk
That part of the output in the log file is:
[21:50:51] Checking for missing log files [ Skipped ]
...
user364819
1
vote
2
answers
306
views
.passw hidden files in /etc
Rkhunter reported me that it found hidden files in /etc:
Warning: Hidden file found: /etc/.group.48239632746: ASCII text
Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text
Warning: ...
- 616
1
vote
1
answer
2k
views
rkhunter scan results
Im new to Ubuntu and im looking for some help.
I've scanned my Ubuntu with rkhunter and I have some concerning results:
Warning: The following processes are using deleted files:
Process: /sbin/init ...
- 11
1
vote
3
answers
3k
views
Run rkhunter regularly on a desktop system
I want to get a warning on my desktop when rkhunter finds something odd on my system.
I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore.
Now I want to ...
- 32.4k
1
vote
1
answer
552
views
Is rkhunter still required and appropriate? Nothing seems to have been written on it since 2015. Thanks
I want to use my Ubuntu 20.10 Groovy Gorilla desktop for internet banking and making purchases. Good digital hygiene is of course the first defence but i'd like to make sure that rootkits are ...
- 77
1
vote
1
answer
40
views
Have the rkhunter commands changed since the 12.04 version? [closed]
I have downloaded rkhunter and have instructions of how to use it on 12.04. But I now have 16.04, so are all the commands the same still on this version?
- 11
1
vote
1
answer
320
views
Is there any conflicts between running rkhunter and chkrootkit on one system?
Can I run rkhunter and chkrootkit at the same time on my Ubuntu Linux laptop without having to worry about conflicts?
user496917
1
vote
1
answer
706
views
Backdoor.Linux.Gafgyt.A - How to detect an infection with this backdoor.
Yesterday I found out about the existence of the Backdoor.Linux.Gafgyt.A trojan backdoor.
I did run chkrootkit vs 0.49 and rkhunter 1.40. But surprisingly in the logs, I could not see these programs ...
- 61
1
vote
0
answers
96
views
I get a "Warning" after adding the line APT_AUTOGEN="yes" to /etc/default/rkhunter with gedit [duplicate]
The warning is the following: "(gedit:38572): Tepl-WARNING **: 09:45:20.468: GVfs metadata is not supported. Fallback to TeplMetadataManager. Either GVfs is not correctly installed or GVfs metadata ...
1
vote
0
answers
68
views
How to verify system file change warnings in rkhunter
When running rkhunter I try to use
rkhunter --propupd
when it is finished, but once in a while I forget, and the next time it is run I get the inevitable file changed warning for a few files.
...
1
vote
1
answer
3k
views
Rkhunter shows 5 possible rootkits
Rkhunter shows 5 rootkits
System checks summary
File properties checks...
Files checked: 149
Suspect files: 0
Rootkit checks...
Rootkits checked : 480
Possible rootkits: 5
Applications checks...
...
- 61
1
vote
0
answers
497
views
Rkhunter show me "warning"
Why rkhunter shows me a "warning" in /usr/bin/lwp-request? At the end of the dialog shows: Files properties checks...
Files checked: 149
Suspect Files: 1
With ClamAV it ...
- 722
1
vote
1
answer
1k
views
Rkhunter warning: file properties have changed
I am testing rkhunter on a Ubuntu server 16.04 in Virtualbox.
The 11th of October I received an email alert from rkhunter inviting me to "Please inspect this machine, because it may be infected".
So ...
- 1,607
1
vote
0
answers
1k
views
lsattr: command not found
When I first ran rkhunter on my Ubuntu 16.04 VPS, I noticed an error with lsattr when checking for prerequisites:
Warning: Checking for prerequisites [ Warning ]
Unable to find 'lsattr' ...
- 11
1
vote
1
answer
958
views
Run a script after unattended-upgrades runs (e.g. to update rkhunter)
Hi I'd like to be able to auto update rkhunter when upgrades happen automatically, but I can't seem to find a way to do this.
I'd not want this to happen after a manual install via apt-get though or ...
- 113
1
vote
0
answers
743
views
How to test rkhunter to make sure its functioning well?
I have a Ubuntu 15.10 Linux laptop PC with rkhunter installed now all I need to do is to confirm it working well like if there is an antivirus on your pc you will go to the eicar site and download the ...
user491354
1
vote
1
answer
453
views
Should I be worried about these scan results form rkhunter?
Should I be worried about these scan results form rkhunter?
[22:09:40] Info: Starting test name 'passwd_changes'
[22:09:40] Checking for passwd file changes [ Warning ]
[22:09:40] ...
- 361
0
votes
1
answer
497
views
Is my computer secure?
I was using Rkhunter and this was displayed.
[ Rootkit Hunter version 1.4.2 ]
File updated: searched for 175 files, found 141
baymax@vostro:~$ sudo rkhunter -c --enable all --disable none --rwo
...
- 3
0
votes
1
answer
1k
views
Rootkit detector: rkhunter auto database update options
In the rkhunter config file here /etc/default/rkhunter it says:
# Defaults for rkhunter automatic tasks
# sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter
#
# This is a POSIX shell ...
user364819
0
votes
1
answer
2k
views
RKhunter Does Not Perform All Checks
Can someone tell me how to config / force rkhunter to check everything on my system? The checks are skipped, even if I run rkhunter --checkall
Performing malware checks
Checking running ...
- 659
0
votes
1
answer
846
views
RKhunter possible false positive
Is /usr/bin/size being infected a false positive? However after I scanned the second time, it was no longer infected. I used the same command to scan using RKhunter sudo rkhunter -c twice and found it ...
- 27
0
votes
1
answer
77
views
Should I uncomment out the code referring to unhide.rb (as I am using unhide.rb)?
I am using rkhunter 1.4.2, on Ubuntu 14.10, and I am also using the suggested package unhide.rb with it, so should I uncomment out this setting referring to it in the rkhunter.conf file?:
#...
user364819
0
votes
0
answers
116
views
rkhunter and wpa_supplicant
I suspect my laptop being hacked.
Here's one of the rkhunter log lines I do not like:
[11:01:45] Info: Starting test name 'packet_cap_apps'
[11:01:46] Checking for packet capturing applications ...
- 13
0
votes
0
answers
1k
views
rkhunter warnings
Hi I just ran rkhunters and got a lot of warnings which are not the first ones I found the first time a I ran it.
I'll drop here the results to see if someone can help me and tell tell me if they are ...
- 9
0
votes
1
answer
730
views
Possible that 2,3 week old os is infected? rkhunter, chkrootkit
Problem:
Rootkit checks...
Rootkits checked : 498
Possible rootkits: 5
/usr/bin/bsd-mailx [ Warning ]
reinstalled, message keeps but now new: /usr/bin/lwp-...
- 174
0
votes
1
answer
310
views
rkhunter suspicious file type ecryptfs-user-Private text
Should I be concerned about this warning?
Warning: Suspicious file types found in /dev:
[18:17:04] /dev/shm/ecryptfs-user-Private: ASCII text
I deleted the file, but when I rebooted it was recreated....
- 3