Rkhunter warnings help

Question

I installed Ubuntu 14.04 a few days ago. I've made a scan with a RkHunter and got a few warnings that I don't really know what to do with. I read about false positives a little bit but I didn't find the answer for myself really. I got those errors:

Checking /dev for suspicious file types         [ Warning ]
[19:44:16] Warning: Suspicious file types found in /dev:
[19:44:16]          /dev/.udev/rules.d/root.rules: ASCII text
[19:44:16]   Checking for hidden files and directories       [ Warning ]
[19:44:16] Warning: Hidden directory found: /etc/.java: directory
[19:44:16] Warning: Hidden directory found: /dev/.udev: directory
[19:44:16] Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs'
Checking for group file changes                 [ Warning ]
[19:44:16] Warning: Group 'winbindd_priv' has been added to the group file.

Should I be worried ?

Answer 1

Ok lets run this down:

[19:44:16] /dev/.udev/rules.d/root.rules: ASCII text

• a file holding ASCII text is suspicious? Why?
• there was a bug in it in 2010 so the file seems normal to me.
• google says false positive.

[19:44:16] Warning: Hidden directory found: /etc/.java: directory

[19:44:16] Warning: Hidden directory found: /dev/.udev: directory

[19:44:16] Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs'

• hidden files are a problem? Why? Hidden file to me seem a -feature- of linux.
• bug report and fix.
• The "fix" also shows a serious flaw in rkhunter: putting files into a configuration file so it skips them is just plain stupid. It really is. Think about what this means: so if I add -all- files on my disk to the configuration file so it skips them I can never get a rootkit? No, it actually means a rootkit has extra places to hide itself. Seems counterproductive to me.

[19:44:16] Warning: Group 'winbindd_priv' has been added to the group file.

• bug report and fix. Fix is part of correctly setting up winbindd.

---

By the way: you are the one choosing to use rkunter so you will also need to do these searches yourself on any warning you get.

Either don't use rkhunter or install a -second- separate (so not Lynis as it is a rkhunter clone) (chrootkit.org seems down; software is still available in the repositories). Run both and discard anything only 1 of them reports as a problem as a false positive. Package information on debian for rkhunter also mentions this.

Answer 2

No, you shouldn't be worried about false positives.

How to install, configure and use RKhunter is explained in the RKhunter community page. Also there you can find detailed explanations about some expected results like yours and how to properly whitelist them.