Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

when I scanned my Ubuntu 10.04 with rkhunter a root kit hunter toolkit, it gave following warning:

Is there something that I have to worry about.

            [23:06:19]   /usr/sbin/adduser                               [ Warning ]
            [23:06:19] Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executable
            [23:06:20]   /usr/sbin/rsyslogd                              [ Warning ]
            [23:06:20] Warning: The file properties have changed:
            [23:06:22]   /usr/bin/dpkg                                   [ Warning ]
            [23:06:22] Warning: The file properties have changed:
            [23:06:22]   /usr/bin/dpkg-query                             [ Warning ]
            [23:06:22] Warning: The file properties have changed:
            [23:06:24]   /usr/bin/ldd                                    [ Warning ]
            [23:06:24] Warning: The file properties have changed:
            [23:06:24] Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executable
            [23:06:24]   /usr/bin/logger                                 [ Warning ]
            [23:06:24] Warning: The file properties have changed:
            [23:06:25]   /usr/bin/mail                                   [ Warning ]
            [23:06:25] Warning: The file '/usr/bin/mail' exists on the system, but it is not present in the rkhunter.dat file.
            [23:06:27]   /usr/bin/sudo                                   [ Warning ]
            [23:06:27] Warning: The file properties have changed:
            [23:06:29]   /usr/bin/whereis                                [ Warning ]
            [23:06:29] Warning: The file properties have changed:
            [23:06:29]   /usr/bin/lwp-request                            [ Warning ]
            [23:06:29] Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script text executable
            [23:06:29]   /usr/bin/bsd-mailx                              [ Warning ]
            [23:06:29] Warning: The file '/usr/bin/bsd-mailx' exists on the system, but it is not present in the rkhunter.dat file.
            [23:06:30]   /sbin/fsck                                      [ Warning ]
            [23:06:30] Warning: The file properties have changed:
            [23:06:30]   /sbin/ifdown                                    [ Warning ]
            [23:06:30] Warning: The file properties have changed:
            [23:06:31]   /sbin/ifup                                      [ Warning ]
            [23:06:31] Warning: The file properties have changed:
            [23:06:34]   /bin/dmesg                                      [ Warning ]
            [23:06:34] Warning: The file properties have changed:
            [23:06:35]   /bin/more                                       [ Warning ]
            [23:06:35] Warning: The file properties have changed:
            [23:06:36]   /bin/mount                                      [ Warning ]
            [23:06:36] Warning: The file properties have changed:
            [23:06:37]   /bin/which                                      [ Warning ]
            [23:06:37] Warning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable
            [23:08:58]   Checking /dev for suspicious file types         [ Warning ]
            [23:08:58] Warning: Suspicious file types found in /dev:
            [23:08:58]   Checking for hidden files and directories       [ Warning ]
            [23:08:58] Warning: Hidden directory found: /etc/.java
            [23:08:58] Warning: Hidden directory found: /dev/.udev
            [23:08:58] Warning: Hidden directory found: /dev/.initramfs
            [23:09:01]   Checking version of Exim MTA                    [ Warning ]
            [23:09:01] Warning: Application 'exim', version '4.71', is out of date, and possibly a security risk.
            [23:09:01]   Checking version of GnuPG                       [ Warning ]
            [23:09:01] Warning: Application 'gpg', version '1.4.10', is out of date, and possibly a security risk.
            [23:09:01]   Checking version of OpenSSL                     [ Warning ]
            [23:09:01] Warning: Application 'openssl', version '0.9.8k', is out of date, and possibly a security risk.
share|improve this question

migrated from stackoverflow.com Feb 2 '11 at 2:36

This question came from our site for professional and enthusiast programmers.

    
Good question, but not for SO. –  Rook Feb 1 '11 at 18:00
    
@ Rook :what's SO ? –  gkt.pro Feb 1 '11 at 18:03
    
SO==Stack Overflow, and this is a question for ServerFault, but it will be moved automatically, don't worry. –  Rook Feb 1 '11 at 18:04
    
Linux kernel land rootkits are DEAD. Hypervisor rootkits still work and you don't have one, and you can't detect it with rkhunter. –  Rook Feb 2 '11 at 6:42
5  
Linux kernel land rootkits are dead ? I'll have some of what you're smoking. –  Sirex Feb 2 '11 at 8:00
add comment

1 Answer 1

Regarding the warnings about the file properties and commands that have changed, you will need to run the following command after every software update, and after every time you perform a system definitions change:

rkhunter --propupd

Otherwise, you can't know if the properties have changed due to your own change, or due to malicious behavior. This command updates the database of files that rkhunter knows.

And even better: run rkhunter before you perform any software update.

Talking about software updates, you have several applications that are reported as 'out of date'. You should check if your repositories have newer versions:

sudo apt-get update && sudo apt-get upgrade

Good hunting!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.