Tag Info

Hot answers tagged

14

First of all, they are only warnings, not errors. Warning: The modules file '/proc/modules' is missing. rkhunter is trying to check the kernel modules, but it cannot because the file /proc/modules doesn't exist. You can disable the test by changing the below line: DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps" to: ...


4

In this case, I wouldn't be too worried as it only detected a filename to be present that is not unlikely to be created by something completely unrelated due the common nature of the word update. The more important files like /tmp/.bugtraq are missing. Also, Slapper is 12 years old and used a vulnerability that has long been closed. If you run rkhunter ...


4

Updating files is often done by writing a new file in the same directory followed by renaming the file on top of the old file. This method is usually applied to everything installed through a package manager, but also to any update performed to executables and libraries even if updated for other reasons. This way of updating files ensure that any process ...


4

I spot checked a few of those, and they all appear to be single-bit errors. At this point I'd consider replacing the hard drive, using RAID/ZFS, etc.


3

I agree this isn't an intrusion, but a hardware error of some sort. I would also consider whether you have a failing RAM stick, and run a memtest86 on the host server - single-bit errors could also be non-ECC RAM errors. If you have ECC RAM, you can rule this out (every server should use ECC RAM of course, and preferably ZFS to detect RAM and disk ...


3

From the timestamps it looks like you updated several programs built Dec-19th about 7:30. Modification timestamps should be the build timestamps. It depends on how they get moved into place. Some programs are linked to through /etc/alternatives, and the symbolic links will have the timestamp of the install.This could be an automatic security update. ...


3

I just used the command "yum provides /path/binary" on a 64bit CentOS box I have here and all of those binaries are part of the util-linux package. Which is listed in your recent updates.


2

Is it possible that you have used ''prelink'' at some point between now and 3rd September 2009. Prelink has a MD5 flag: --md5 This is similar to --verify option, except instead of outputing the content of the binary or library before prelinking to standard output MD5 digest is printed. See md5sum(1). Check those binaries with that, it should then ...


2

Seems to me you're not using a rkhunter that is supplied from your distribution, but rather downloaded (the latest?) and installed it yourself, and because a lot of the distribution specifics has not been whitelisted these warnings are generated. Oh, I used google.com btw.


2

I am no rkhunter expert by anymeans, but their are some things I would want to know. Did you install rkhunter on a fresh install with known good packages? I believe you are supposed to install on a fresh system then run, rkhunter --propupd so it can build its database of known good files. Then when you run after that it knows what to compare it too. I ...


2

According to your log entry, its clear that your IP is not authorized to send emails from the server you are sending this email. Here are the details of the issue: http://support.google.com/mail/bin/answer.py?hl=en&answer=10336


1

The other option I found was to disable these properties tests completely. If you edit /etc/rkhunter.conf and look for the DISABLE_TESTS line and change it to: DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps properties" The properties test is the one checking and returning false positives on the file hashes.


1

A changed inode number usually means the file has been replaced. It could as you say be due to an expected update. I'd verify the md5sums of those files match those of the distributed versions. If you have another comparable system around, it might be easiest to compare to that. Take a look at the accepted answer at rkhunter reports change in file ...


1

Firstly, these are not "false-positives". rkhunter is reporting facts; it is not applying any interpretation to those facts. Does this report means that each of these processes is trying to use a file that has been deleted, or that it has used at some point a file that existed at the time but got deleted afterwards? The report is showing you ...


1

Does your web application use curl or do any network operations such as talking to a database? Whenever a network connection is made source IP, source port, destination IP and destination port must be chosen. The source port is chosen from the ephemeral range. I suspect that one of these network connections chose the port 60922 and was using it at the ...


1

It turns out that ISPConfig has it's own scheduled task setup. In this file, /usr/local/ispconfig/server/mods-available/monitor_core_module.inc.php, there is a _monitorRkHunter function that was set to run the rkhunter scan at 2300 UTC. Thanks for your help, guys!


1

Well, if your system was compromised then you couldn't trust your logs anyway. If you haven't run rkhunter since 2009 and you have updated your system, then these might be false positives. Otherwise it's time to take a good look at your backups.


1

Those files /bin/GET /bin/wget /usr/local/bin/rkhunter are all files you should expect to be there (though GET is usually in /usr/bin). wget is a normal part of Linux and a useful program. Evidently some rootkits make use of it and, presumably, include it themselves sometimes. I installed wget on my Windows PCs and AVG often reports it as a suspicious ...


1

Does yum search rkhunter show anything? Is the yum repository cache up to date? Have you run yum update recently? Also, Centos 4.8 is very old. I'm not even sure it's still supported.. I wouldn't be surprised if the remote repos for 4.8 had been removed.



Only top voted, non community-wiki answers of a minimum length are eligible