rkhunter (Rootkit Hunter) is an easy-to-use tool for Unix which checks systems for the presence of rootkits and other unwanted tools.

learn more… | top users | synonyms

2
votes
1answer
131 views

Is there any reference for current binary file checksums (Ubuntu 12.04 LTS)

I'm using rkhunter to check my system regularly - Sometimes rkhunter output some warnings on file changes (after update e.g.) rkhunter gives me the new file checksum and the old one, but is there any ...
2
votes
1answer
138 views

RKHunter reports change in file properties, but different hash length

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash. [11:47:13] Warning: The file properties have changed: ...
1
vote
1answer
170 views

rkhunter: “Suspicious Shared Memory segments”

I have here a new installed server with CentOS7 and a GroupOffice installation on it. After installing rkhunter and starting a rkhunter check I get: [09:58:15] Suspicious Shared Memory segments [09:...
1
vote
1answer
160 views

Correct procedure for RKHunter file changes

I run RKHunter on Ubuntu as well as as automated system / package updates. Last night I started receiving RKHunter warnings as listed below and whilst it's obviously easy for me to just do: rkhunter -...
0
votes
1answer
133 views

rkhunter - deleted files - whitelist issues

I am working to secure a fresh Debian LAMP deployment and decided to include rkhunter (v1.4.2) in my security solution. I have run it using the following options: rkhunter -c --enable all --disable ...
0
votes
1answer
201 views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
0
votes
1answer
109 views

Whitelisting session files with rkhunter

I am running a webserver and am saving PHP sessions to /dev/shm -- rkhunter is flagging the session files: Warning: Suspicious file types found in /dev: /dev/shm/...
0
votes
1answer
78 views

rkhunter warning message /bin/sh

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain. Warning: The file properties have changed: File: /bin/...
1
vote
0answers
47 views

Nginx uses another ports rather than tcp 80 and 443

Rkhunter shows that nginx uses two UDP ports rather than 80 and 443 which I have of course enabled, but not those which rkhunter shows as hidden ports: [12:56:58] Checking for hidden ports ...
1
vote
0answers
100 views

rkhunter (1.3.8), crontab, ubuntu 12.04.1 — Very strange behavior

1.3.8-10 Rkhunter, Ubuntu 12.04.1 I have a strange problem with rkhunter. I haven't found anything helpful after googling extensively... for days. If I run rkhunter from crontab I'll get a bunch of ...
0
votes
0answers
334 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...