rkhunter (Rootkit Hunter) is an easy-to-use tool for Unix which checks systems for the presence of rootkits and other unwanted tools.

learn more… | top users | synonyms

0
votes
0answers
30 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
1
vote
1answer
31 views

Is there any reference for current binary file checksums (Ubuntu 12.04 LTS)

I'm using rkhunter to check my system regularly - Sometimes rkhunter output some warnings on file changes (after update e.g.) rkhunter gives me the new file checksum and the old one, but is there any ...
2
votes
1answer
53 views

What to do if rkhunter finds a possible rootkit?

ran rkhunter tonight, and I got this for the results: [04:17:34] System checks summary [04:17:34] ===================== [04:17:34] [04:17:34] File properties checks... [04:17:34] Files checked: 133 ...
4
votes
3answers
133 views

rkhunter warns of inode change by no file modification date changes

I have several systems running Centos 6 with rkhunter installed. I have a daily cron running rkhunter and reporting back via email. I very often get reports like: ---------------------- Start ...
1
vote
2answers
129 views

rkhunter warnings - whitelisting

I'm getting a set of warnings via rkhunter that I can't seem to suppress using ALLOWDEVFILE. Here's a piece of what gets flagged: Checking /dev for suspicious file types [ Warning ] Warning: ...
-1
votes
1answer
349 views

RKHunter reported processes that are using deleted files or are listening on the network

I ran Rootkit Hunter 1.4.0 on a Debian Wheezy server and I am confused by the output. I enabled every tests using the following piece of configuration: ENABLE_TESTS="all" DISABLE_TESTS="none" The ...
0
votes
1answer
43 views

Whitelisting session files with rkhunter

I am running a webserver and am saving PHP sessions to /dev/shm -- rkhunter is flagging the session files: Warning: Suspicious file types found in /dev: ...
2
votes
1answer
67 views

RKHunter reports change in file properties, but different hash length

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash. [11:47:13] Warning: The file properties have changed: ...
0
votes
1answer
54 views

rkhunter warning message /bin/sh

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain. Warning: The file properties have changed: File: ...
0
votes
1answer
106 views

Correct procedure for RKHunter file changes

I run RKHunter on Ubuntu as well as as automated system / package updates. Last night I started receiving RKHunter warnings as listed below and whilst it's obviously easy for me to just do: rkhunter ...
1
vote
1answer
567 views

Rkhunter triggered last night warning for a possible infection. What next?

Last night rkhunter triggered with the following warnings: [04:10:23] Warning: Network TCP port 32982 is being used by /usr/lib/apache2/mpm-prefork/apache2. Possible rootkit: Solaris Wanuk ...
1
vote
0answers
96 views

rkhunter (1.3.8), crontab, ubuntu 12.04.1 — Very strange behavior

1.3.8-10 Rkhunter, Ubuntu 12.04.1 I have a strange problem with rkhunter. I haven't found anything helpful after googling extensively... for days. If I run rkhunter from crontab I'll get a bunch of ...
0
votes
1answer
377 views

Using Nagios With RKhunter

I have installed rkhunter and would like the rootkit checks to be done automatically with alerts. How would i go about integrating RKhunter with nagios? One scenario would be if a root kit is found, i ...
0
votes
1answer
246 views

How can I send remote emails using exim?

I'm on Debian I'm trying to send an email to email@gmail.com but it's not working although I changed the configtype in update-exim4.conf.conf to "internet". It doesn't give me any output but I can't ...
2
votes
2answers
122 views

Single file changed: intrusion or corruption?

rkhunter reported a single file change on a virtual server (netstat binary). It didn't report any other warning. The change was not the result of a package upgrade (I reinstalled it and the checksum ...
1
vote
4answers
891 views

Crontab and rkhunter Scheduling

I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter. Every day at 7pm EST the rkhunter script is ...
4
votes
2answers
1k views

Rkhunter reports file properties have changed

I am running a fully updated LTS copy of Ubuntu server. Today I ran rkhunter (as I do from time to time). This is the output I got: Warning: The file properties have changed: [15:52:25] ...
1
vote
1answer
502 views

Can someone explain this rkhunter report?

This is my rkhunter output that I recently set so I get this report every morning, could somone please explain if I have a serious problem here (I know about httpd, openssl, php and sshd not up to ...
7
votes
1answer
2k views

rkhunter error message, how to fix?

I am receiving the following errors from rkhunter. I have recently upgraded my server from lenny to squeeze and this may have caused the problem. How do I fix this or hide the error messages? ...
0
votes
1answer
332 views

rkhunter warnings

Ran rkhunter (centos, cpanel box) /usr/bin/groups [ Warning ] /usr/bin/whatis [ Warning ] /usr/bin/ldd ...
0
votes
2answers
460 views

rkhunter warning messages

i performed rkhunter -c on my server, and i get warnings for following files: /bin/GET /bin/wget /usr/local/bin/rkhunter Performing trojan specific checks Checking for enabled xinetd services ...
1
vote
2answers
1k views

rkhunter reports change in file properties, but I don't see that they've been updated by yum

Maybe I'm being overcautious, but I recently received the following warnings from rkhunter: Warning: The file properties have changed: File: /bin/dmesg Current hash: ...
1
vote
3answers
757 views

Yum install problems

I'm trying to install rkhunter via yum on CentOS 4.8, but it's just not happening... Loading "fastestmirror" plugin Setting up Install Process Setting up repositories update 100% ...