Questions tagged [rkhunter]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1
votes
1answer
48 views

hidden files and directories warnings

I received these rkhunter results; what are these files, and are they dangerous? [23:17:48] Checking for hidden files and directories [ Warning ] [23:17:48] Warning: Hidden file found: /etc/....
-1
votes
1answer
98 views

Mint 19 tcpd INFECTED sha1sum

When I use rkhunter it always shows two warnings and possible 4 rootkit information: Checking for suspicious (large) shared memory segments [ Warning ] Checking for hidden files and directories ...
0
votes
0answers
43 views

rkhunter pkgmgr for arch-based distro

I'm trying to run rkhunter with the following command: sudo rkhunter --check --rwo --pkgmgr=pacman However, as in the manual, there is no package manager option for pacman. How can I specify the ...
0
votes
1answer
294 views

rkhunter found 7 possible rootkits

Today I installed Ubuntu 18.10 and ran rkhunter on it. At first it said that there are 4 possible rootkits, but after second check it detected 7. During checking there was everything green and ok, ...
0
votes
1answer
399 views

Mint 19 - rkhunter 1.4.6 won't update

System: Linux Mint 19 Cinnamon 64-bit, based on Ubuntu 18.04. RKHunter: packaged version 1.4.6-2. Unfortunately, when I try to update its database, I get error: $ sudo rkhunter --update [ Rootkit ...
0
votes
1answer
260 views

Rkhunter update skips checking some files

Upon entering the command Rkhunter --update in my Kali Linux distribution. The result is as follows [ Rootkit Hunter version 1.4.6 ] Checking Rkhunter data files... Checking file mirrors.dat ...
0
votes
1answer
409 views

How to install skdet for rkhunter for Performing Suckit Rookit additional checks?

OS: Linux Mint 18.2 Cinnamon 64-bit Although I don't use the rkhunter much, probably several times a year, today I decided to look at it. I found in rkhunter log: /var/log/rkhunter.log that it ...
1
vote
1answer
1k views

How to upgrade rkhunter to most current version? [duplicate]

I installed rkhunter 1.4.2 but I wanted rkhunter 1.4.4. Currently I receive a warning for: /usr/bin/lwp-request I assume this warning is in error or the file is corrupt. Additional error include:...
1
vote
1answer
2k views

Rkhunter warning: file properties have changed

I am testing rkhunter on a Ubuntu server 16.04 in Virtualbox. I received an email alert by rkhunter on the 11th of October, inviting me to "Please inspect this machine, because it may be infected". ...
0
votes
2answers
358 views

Better latest version or the package for rkhunter and chkrootkit?

The rkhunter version of the ubuntu package is currently 1.4.0, while the installer is version 1.4.4 The repo version of chkrootkit is 0.49, while its installer is 0.52 Since security is a major ...
0
votes
1answer
96 views

Information on when packages were installed/updated by whom and coupling updates with rkhunter scans (rkhunter warnings)

So rkhunter gives me these warnings (in the logfile) beyond this one (which seems to be a false positive): Checking for passwd file changes [ Warning ] Warning: User 'logcheck' has ...
0
votes
1answer
141 views

Will mounting sda6 to run rkhunter allow the malware to become active?

I think I've got malware on my laptop. You see, I got suspicious disc activity after accessing a dodgey website. So I'm going to run rkhunter on the laptop from a live knoppix USB stick. My linux ...
24
votes
3answers
21k views

rkhunter gives me a warning for “/usr/bin/lwp-request” - what should I do? [Debian 9]

So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so: /usr/bin/lwp-request [ Warning ...
0
votes
1answer
705 views

Update only upgraded packages with rkhunter --propupd

When upgrading packages on my system with apt-get, usually we update the rkhunter file database with sudo rkhunter --propupd The drawback is, that this updates the properties of all files that are ...
1
vote
2answers
936 views

How to make rkhunter only check for rootkits, and nothing else

At the time, I check my system like this: rkhunter --check --enable all --disable none --report-warnings-only Or shorter version: rkhunter -c --enable all --disable none --rwo But this gives me ...
0
votes
3answers
576 views

What is /dev/shm/lttng-ust-wait-5 for?

I get those messages on rkhunter --check --rwo: /dev/shm/lttng-ust-wait-5-13: data /dev/shm/lttng-ust-wait-5-1000: data /dev/shm/lttng-ust-wait-5: data I can ignore them in /etc/...
4
votes
2answers
7k views

rkhunter warning about ssh root access when that access is not allowed on the system

I just ran rkhunter --check and all was good except this: Checking if SSH root access is allowed [ Warning] What does this warning mean? SSH root access is not allowed on this ...
1
vote
1answer
329 views

rkhunter reports /sbin/ip has changed

I am using rkhunter 1.4.2 on CentOS 6.5. A message, in /var/log/rkhunter.log is Warning: The file properties have changed: [09:40:35] File: /sbin/ip [09:40:35] Current size: 247396 ...
0
votes
1answer
1k views

rkhunter warnings about a script and a hidden directory

When I run a scan with rkhunter I get 2 warnings. I checked the log file and warnings are as the following: Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb:...
15
votes
2answers
12k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
4
votes
2answers
2k views

rkhunter warns about chkconfig

I ran rkhunter and received the following warnings in its output: $ rkhunter --update $ rkhunter -c ... ... ... Performing file properties checks /sbin/chkconfig ...