rkhunter (Rootkit Hunter) is an easy-to-use tool for Unix which checks systems for the presence of rootkits and other unwanted tools.

learn more… | top users | synonyms

1
vote
2answers
235 views

rkhunter warnings - whitelisting

I'm getting a set of warnings via rkhunter that I can't seem to suppress using ALLOWDEVFILE. Here's a piece of what gets flagged: Checking /dev for suspicious file types [ Warning ] Warning: ...
2
votes
1answer
48 views

Is there any reference for current binary file checksums (Ubuntu 12.04 LTS)

I'm using rkhunter to check my system regularly - Sometimes rkhunter output some warnings on file changes (after update e.g.) rkhunter gives me the new file checksum and the old one, but is there any ...
2
votes
1answer
80 views

RKHunter reports change in file properties, but different hash length

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash. [11:47:13] Warning: The file properties have changed: ...
1
vote
1answer
113 views

Correct procedure for RKHunter file changes

I run RKHunter on Ubuntu as well as as automated system / package updates. Last night I started receiving RKHunter warnings as listed below and whilst it's obviously easy for me to just do: rkhunter ...
0
votes
1answer
54 views

Whitelisting session files with rkhunter

I am running a webserver and am saving PHP sessions to /dev/shm -- rkhunter is flagging the session files: Warning: Suspicious file types found in /dev: ...
0
votes
1answer
62 views

rkhunter warning message /bin/sh

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain. Warning: The file properties have changed: File: ...
1
vote
0answers
98 views

rkhunter (1.3.8), crontab, ubuntu 12.04.1 — Very strange behavior

1.3.8-10 Rkhunter, Ubuntu 12.04.1 I have a strange problem with rkhunter. I haven't found anything helpful after googling extensively... for days. If I run rkhunter from crontab I'll get a bunch of ...
0
votes
0answers
72 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...