Questions tagged [rkhunter]
The rkhunter tag has no usage guidance.
30
questions
0
votes
1
answer
87
views
Are hidden files in /usr/share/man a security concern?
rkhunter reported that
[17:15:45] Checking for hidden files and directories [ Warning ]
[17:15:45] Warning: Hidden file found: /etc/.updated: ASCII text
[17:15:45] Warning: Hidden file found: /...
- 2,643
1
vote
1
answer
112
views
Is a `preloaded library` warning from `rkhunter` a reason to worry?
[17:16:52] Checking for preloaded libraries [ Warning ]
[17:16:53] Warning: Found preloaded shared library: /usr/lib/arm-linux-gnueabihf/libarmmem-${PLATFORM}.so
########
#ls /usr/lib/...
- 2,643
0
votes
1
answer
188
views
rkhunter warning on /dev/shm/mono.*. Is this false positive?
rkhunter is giving warning on /dev/shm/mono.*. I couldn't find anywhere in the web reference to this file related to rkhunter warnings.
[12:38:29] Checking /dev for suspicious file types [ ...
0
votes
0
answers
425
views
How to Verify Rkhunter False Positives
I have a fresh install of CentOS 7 server with a fressh install of cpanel/whm. I checked / verified everything was clean, prior to restoring my cpanel backup from a different server.
After the cpanel ...
- 123
0
votes
1
answer
83
views
rkhunter and unattended-upgrades
I have an Ubuntu 18.04 system running with rkhunter installed. I keep getting warnings in the rkhunter.log after unattended-upgrades has upgraded the system.
The solution to this would be running ...
- 5,330
0
votes
1
answer
68
views
hashes are the same: rmmod, modprobe, modinfo, modinfo, lsmod, insmod, depmod
I am get this same output after checking hashes of rmmod, modprobe, modinfo, modinfo, lsmod, insmod, depmod
root@user:/var/log/apt# md5sum /sbin/modprobe
150aa565f1e37e2fd200523b6b4fcedf /sbin/...
- 84
8
votes
3
answers
12k
views
Invalid WEB_CMD configuration option: Relative pathname: "/bin/false"
I am on Ubuntu, I am trying to install rkhunter.
I've tried
apt-get install rkhunter
success
But then, I did
rkhunter --update
I kept getting
Invalid WEB_CMD configuration option: ...
- 372
2
votes
1
answer
110
views
RKHUNTER does not recognise common options
At the bottom of rkhunter.conf (I also tried placing it separately in rkhunter.conf.local), and after checking for invisible chars,
Unknown configuration file option: CRON_DAILY_RUN="false"
...
- 272
0
votes
1
answer
2k
views
rkhunter giving ssh root login warning even when both config files are set to "no" root login
I'm getting a warning from rkhunter, even though the sshd and rkhunter options for root login are both set to "no". Running Centos 7.6.1810 with rkhunter 1.4.6.
Here are grep results which verify ...
- 11
1
vote
2
answers
16k
views
create a systemd startup script that delays 30 minutes
I tried to create a systemd startup script that starts an rkhunter scan 30 minutes after system start of my laptop, like this:
[Unit]
Description=starts rkhunter and displays any findings with zenity
...
- 24.7k
-1
votes
1
answer
500
views
hidden files and directories warnings
I received these rkhunter results; what are these files, and are they dangerous?
[23:17:48] Checking for hidden files and directories [ Warning ]
[23:17:48] Warning: Hidden file found: /etc/....
-1
votes
1
answer
206
views
Mint 19 tcpd INFECTED sha1sum
When I use rkhunter it always shows two warnings and possible 4 rootkit information:
Checking for suspicious (large) shared memory segments [ Warning ]
Checking for hidden files and directories ...
- 1
0
votes
1
answer
1k
views
rkhunter found 7 possible rootkits
Today I installed Ubuntu 18.10 and ran rkhunter on it. At first it said that there are 4 possible rootkits, but after second check it detected 7. During checking there was everything green and ok, ...
4
votes
1
answer
2k
views
Mint 19 - rkhunter 1.4.6 won't update
System: Linux Mint 19 Cinnamon 64-bit, based on Ubuntu 18.04.
RKHunter: packaged version 1.4.6-2.
Unfortunately, when I try to update its database, I get error:
$ sudo rkhunter --update
[ Rootkit ...
- 23.4k
0
votes
1
answer
749
views
Rkhunter update skips checking some files
Upon entering the command Rkhunter --update in my Kali Linux distribution.
The result is as follows
[ Rootkit Hunter version 1.4.6 ]
Checking Rkhunter data files...
Checking file mirrors.dat ...
1
vote
1
answer
1k
views
How to install skdet for rkhunter for Performing Suckit Rookit additional checks?
OS: Linux Mint 18.2 Cinnamon 64-bit
Although I don't use the rkhunter much, probably several times a year, today I decided to look at it.
I found in rkhunter log:
/var/log/rkhunter.log
that it ...
- 23.4k
1
vote
1
answer
2k
views
How to upgrade rkhunter to most current version? [duplicate]
I installed rkhunter 1.4.2 but I wanted rkhunter 1.4.4.
Currently I receive a warning for:
/usr/bin/lwp-request
I assume this warning is in error or the file is corrupt.
Additional error include:...
- 11
3
votes
1
answer
5k
views
Rkhunter warning: file properties have changed
I am testing rkhunter on a Ubuntu server 16.04 in Virtualbox.
I received an email alert by rkhunter on the 11th of October, inviting me to "Please inspect this machine, because it may be infected".
...
- 267
0
votes
2
answers
461
views
Better latest version or the package for rkhunter and chkrootkit?
The rkhunter version of the ubuntu package is currently 1.4.0, while the installer is version 1.4.4
The repo version of chkrootkit is 0.49, while its installer is 0.52
Since security is a major ...
- 267
0
votes
1
answer
139
views
Information on when packages were installed/updated by whom and coupling updates with rkhunter scans (rkhunter warnings)
So rkhunter gives me these warnings (in the logfile) beyond this one (which seems to be a false positive):
Checking for passwd file changes [ Warning ]
Warning: User 'logcheck' has been ...
- 3,410
0
votes
1
answer
487
views
Will mounting sda6 to run rkhunter allow the malware to become active?
I think I've got malware on my laptop. You see, I got suspicious disc activity
after accessing a dodgey website.
So I'm going to run rkhunter on the laptop from a live knoppix USB stick.
My linux ...
- 1
45
votes
3
answers
48k
views
rkhunter gives me a warning for "/usr/bin/lwp-request" - what should I do? [Debian 9]
So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so:
/usr/bin/lwp-request [ Warning ...
- 3,410
0
votes
1
answer
2k
views
Update only upgraded packages with rkhunter --propupd
When upgrading packages on my system with apt-get, usually we update the rkhunter file database with
sudo rkhunter --propupd
The drawback is, that this updates the properties of all files that are ...
- 24.7k
1
vote
2
answers
2k
views
How to make rkhunter only check for rootkits, and nothing else
At the time, I check my system like this:
rkhunter --check --enable all --disable none --report-warnings-only
Or shorter version:
rkhunter -c --enable all --disable none --rwo
But this gives me ...
- 537
0
votes
3
answers
999
views
What is /dev/shm/lttng-ust-wait-5 for?
I get those messages on rkhunter --check --rwo:
/dev/shm/lttng-ust-wait-5-13: data
/dev/shm/lttng-ust-wait-5-1000: data
/dev/shm/lttng-ust-wait-5: data
I can ignore them in /etc/...
- 24.7k
6
votes
2
answers
13k
views
rkhunter warning about ssh root access when that access is not allowed on the system
I just ran rkhunter --check and all was good except this:
Checking if SSH root access is allowed [ Warning]
What does this warning mean? SSH root access is not allowed on this ...
- 5,164
1
vote
1
answer
444
views
rkhunter reports /sbin/ip has changed
I am using rkhunter 1.4.2 on CentOS 6.5.
A message, in /var/log/rkhunter.log is
Warning: The file properties have changed:
[09:40:35] File: /sbin/ip
[09:40:35] Current size: 247396 ...
- 755
0
votes
1
answer
1k
views
rkhunter warnings about a script and a hidden directory
When I run a scan with rkhunter I get 2 warnings. I checked the log file and warnings are as the following:
Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb:...
- 103
16
votes
2
answers
13k
views
rkhunter warns me about root.rules
I run :
:~$ sudo rkhunter --checkall --report-warnings-only
One of the warnings I've got :
Warning: Suspicious file types found in /dev:
/dev/.udev/rules.d/root.rules: ASCII text
and ...
- 1,663
4
votes
2
answers
2k
views
rkhunter warns about chkconfig
I ran rkhunter and received the following warnings in its output:
$ rkhunter --update
$ rkhunter -c
...
...
...
Performing file properties checks
/sbin/chkconfig ...
- 1,847