1

Should I be worried about these scan results form rkhunter?

[22:09:40] Info: Starting test name 'passwd_changes'
[22:09:40]   Checking for passwd file changes                [ Warning ]
[22:09:40] Warning: User 'usermetrics' has been added to the passwd file.
[22:09:40] Warning: User 'clickpkg' has been added to the passwd file.
[22:09:40]
[22:09:40] Info: Starting test name 'group_changes'
[22:09:40]   Checking for group file changes                 [ Warning ]
[22:09:40] Warning: Group 'usermetrics' has been added to the group file.
[22:09:40] Warning: Group 'clickpkg' has been added to the group file.
[22:09:40]   Checking root account shell history files       [ None found ]

I saw a usermetrics line and clickpkg line at the end of my /etc/passwd file as rkhunter reports.

1 Answer 1

0

there is no need to worry. because rkhunter keeps the database of eveyfile during it's installation and compares the file with it's database for changes...and if the file has changed it gives warning. and i am not sure what group you created or any program during installation created,,, be sure to look sudo gedit /var/log/rkhunter.log and look for the changes and mostly the script changes in group and passwd files are whitelisted which means if you change the password of the user it shows warning which is false postive

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .