You have to look for the possible hidden script. The issue still exists, and most of the time, it's a false positive.
Tracking down the alert:
I've tracked the
ps command before and after the script, in
ls /proc/*/status -al > /tmp/lsproc.before.txt
ps axf > /tmp/psaxf.before.txt
ps auxwww > /tmp/psauxwww.before.txt
eval $CHKROOTKIT $RUN_DAILY_OPTS > $LOG_DIR/log.today.raw 2>&1
ls /proc/*/status -al > /tmp/lsproc.after.txt
ps axf > /tmp/psaxf.after.txt
ps auxwww > /tmp/psauxwww.after.txt
And the result is:
$ wc -l /tmp/*.txt
As you can see: the before is the same (
ps aux has one first line for columns that
ls /proc/* doesn't). So before, we have 218 processes.
After, we have still 218 but only 215 (216 - 1) processes in
ps. And I get the alert:
You have 3 process hidden for ps command, so exactly the difference between
What were those processes? I just
diff the two psauxwww*:
my_user 16674 0.0 0.0 13976 1456 ? S 05:25 0:00 sh /one/dedicated/script.sh
my_user 16690 0.0 0.0 13980 1392 ? S 05:25 0:00 sh /one/dedicated/script.sh
my_user 16691 0.0 0.0 44284 2824 ? S 05:25 0:00 ssh [...]
Not hidden, just missing!
So that's just one script, running every minute with my crontab, which is «hidden». But it's not hidden (as I found you can hide some processes): it just disappears during the chkproc test!
So far, I don't see any easy solution.
chkrootkit is written in bash, but
chkproc is compiled...
If you track the missing processes (most probably a cron as in my case), you may:
stop running the cron at the same time the chkrootkit does (not always possible, as sometimes you need to run your cron every minute, no matter what)
quit your script at the exact minute chkrootkit runs, hoping chkrootkit won't run more than one minute, for example in bash you'll add for chkrootkit running at
if [ "`date +%H%M`" = "0625" ]; then exit 0; fi
postpone the execution of chkrootkit a bit, by adding a sleep at the beginning of the
/etc/cron.daily/chkrootkit script, for example if your other script takes less than 15 seconds:
Not ideal, but if you need both crons to run at the same time, you know what to do.