rkhunter (Rootkit Hunter) is an easy-to-use tool for Unix which checks systems for the presence of rootkits and other unwanted tools.

learn more… | top users | synonyms

1
vote
2answers
95 views

rkhunter warnings - whitelisting

I'm getting a set of warnings via rkhunter that I can't seem to suppress using ALLOWDEVFILE. Here's a piece of what gets flagged: Checking /dev for suspicious file types [ Warning ] Warning: ...
4
votes
2answers
72 views

rkhunter warns of inode change by no file modification date changes

I have several systems running Centos 6 with rkhunter installed. I have a daily cron running rkhunter and reporting back via email. I very often get reports like: ---------------------- Start ...
-1
votes
1answer
159 views

RKHunter reported processes that are using deleted files or are listening on the network

I ran Rootkit Hunter 1.4.0 on a Debian Wheezy server and I am confused by the output. I enabled every tests using the following piece of configuration: ENABLE_TESTS="all" DISABLE_TESTS="none" The ...
0
votes
1answer
37 views

Whitelisting session files with rkhunter

I am running a webserver and am saving PHP sessions to /dev/shm -- rkhunter is flagging the session files: Warning: Suspicious file types found in /dev: ...
2
votes
1answer
58 views

RKHunter reports change in file properties, but different hash length

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash. [11:47:13] Warning: The file properties have changed: ...
0
votes
1answer
50 views

rkhunter warning message /bin/sh

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain. Warning: The file properties have changed: File: ...
7
votes
1answer
2k views

rkhunter error message, how to fix?

I am receiving the following errors from rkhunter. I have recently upgraded my server from lenny to squeeze and this may have caused the problem. How do I fix this or hide the error messages? ...
2
votes
2answers
122 views

Single file changed: intrusion or corruption?

rkhunter reported a single file change on a virtual server (netstat binary). It didn't report any other warning. The change was not the result of a package upgrade (I reinstalled it and the checksum ...
0
votes
1answer
96 views

Correct procedure for RKHunter file changes

I run RKHunter on Ubuntu as well as as automated system / package updates. Last night I started receiving RKHunter warnings as listed below and whilst it's obviously easy for me to just do: rkhunter ...
1
vote
1answer
471 views

Rkhunter triggered last night warning for a possible infection. What next?

Last night rkhunter triggered with the following warnings: [04:10:23] Warning: Network TCP port 32982 is being used by /usr/lib/apache2/mpm-prefork/apache2. Possible rootkit: Solaris Wanuk ...
1
vote
0answers
96 views

rkhunter (1.3.8), crontab, ubuntu 12.04.1 — Very strange behavior

1.3.8-10 Rkhunter, Ubuntu 12.04.1 I have a strange problem with rkhunter. I haven't found anything helpful after googling extensively... for days. If I run rkhunter from crontab I'll get a bunch of ...
0
votes
1answer
339 views

Using Nagios With RKhunter

I have installed rkhunter and would like the rootkit checks to be done automatically with alerts. How would i go about integrating RKhunter with nagios? One scenario would be if a root kit is found, i ...
0
votes
1answer
235 views

How can I send remote emails using exim?

I'm on Debian I'm trying to send an email to email@gmail.com but it's not working although I changed the configtype in update-exim4.conf.conf to "internet". It doesn't give me any output but I can't ...
1
vote
4answers
794 views

Crontab and rkhunter Scheduling

I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter. Every day at 7pm EST the rkhunter script is ...
4
votes
2answers
1k views

Rkhunter reports file properties have changed

I am running a fully updated LTS copy of Ubuntu server. Today I ran rkhunter (as I do from time to time). This is the output I got: Warning: The file properties have changed: [15:52:25] ...
1
vote
1answer
472 views

Can someone explain this rkhunter report?

This is my rkhunter output that I recently set so I get this report every morning, could somone please explain if I have a serious problem here (I know about httpd, openssl, php and sshd not up to ...
0
votes
1answer
316 views

rkhunter warnings

Ran rkhunter (centos, cpanel box) /usr/bin/groups [ Warning ] /usr/bin/whatis [ Warning ] /usr/bin/ldd ...
0
votes
2answers
449 views

rkhunter warning messages

i performed rkhunter -c on my server, and i get warnings for following files: /bin/GET /bin/wget /usr/local/bin/rkhunter Performing trojan specific checks Checking for enabled xinetd services ...
1
vote
3answers
749 views

Yum install problems

I'm trying to install rkhunter via yum on CentOS 4.8, but it's just not happening... Loading "fastestmirror" plugin Setting up Install Process Setting up repositories update 100% ...
0
votes
2answers
1k views

rkhunter reports change in file properties, but I don't see that they've been updated by yum

Maybe I'm being overcautious, but I recently received the following warnings from rkhunter: Warning: The file properties have changed: File: /bin/dmesg Current hash: ...