Questions tagged [rkhunter]

rkhunter (Rootkit Hunter) is an easy-to-use tool for Unix which checks systems for the presence of rootkits and other unwanted tools.

Filter by
Sorted by
Tagged with
1 vote
1 answer
2k views

rkhunter update failed, cannot find dat files

I have a CentOs 7.6 up and running with rkhunter for a long time now. After all my os updates, I run rkhunter --update --propupd but it fails since recently. [ Rootkit Hunter version 1.4.6 ] File ...
  • 113
0 votes
0 answers
164 views

How can I prevent rkhunter from always giving me the same warnings?

I get these warnings every single day from Rootkit Hunter: ---------------------- Start Rootkit Hunter Scan ---------------------- Warning: Package manager verification has failed: File: /usr/...
  • 1,087
0 votes
2 answers
635 views

rkhunter: Suspicious file types found in /dev/null : ASCII text

so there is this situation, which is annoying since it sends email with warning during every rkhunter check on some of the servers. Basically, the error is this: Warning: Suspicious file types found ...
0 votes
2 answers
448 views

rkhunter: whitlist for test 'packet_cap_apps'

W have here a CentOS 7 server with rkhunter installed. Since yesterday we get following rkhunter warning: [01:10:30] Info: Starting test name 'packet_cap_apps' [01:10:30] Checking for packet ...
  • 949
1 vote
1 answer
81 views

Rkhunter verbose cronjob is not working

I'm on Debian 9.5 and have the following /etc/cronjob.weekly/rkhunter file : #!/bin/sh OUTPUT=`rkhunter --cronjob --report-warnings-only` if [ "$OUTPUT" != "" ] then echo $OUTPUT | mail -s "[...
0 votes
1 answer
111 views

anacron fails to run rkhunter each day [duplicate]

I put a rkhunter script in daily.cron on Apache Centos 7. When I manually run the script, it works fine. but leaving it in daily.cron it fails to run. I get this email every day instead. /etc/cron....
  • 101
0 votes
2 answers
818 views

rkhunter: prelinking hash function warning

We are using rkhunter to check to scan our server periodically. Server operating system is CentOS 6/7. But since last rkhunter update (to currently version 1.4.4) we getting following warning message: ...
  • 949
1 vote
1 answer
4k views

Add a file/directory to rkhunter checking

My question is very simple and I'm very surprised to see that this question haven't be asked before. How to add a file or a directory to rkhunter checking ? With that I could see my directory appears ...
  • 33
0 votes
1 answer
615 views

How to get rkhunter PORT_WHITELIST='* ...' to work on Ubuntu 16.04?

My /etc/rkhunter.conf.local contains this line: PORT_WHITELIST='* TCP:7000' If I run rkhunter -c it appears that the star is being shell expanded: root@willow / # rkhunter -c Invalid entry ...
0 votes
1 answer
447 views

Removing RKHunter (installed with apt) when RKhunter Installed from source

I installed rkhunter from source (1.40 I think) and then later updated to 1.4.2 from source (as there is no app update function in rkhunter and the latest version in apt is old) however that means I ...
2 votes
1 answer
613 views

rkhunter: After some days I get "The system has changed to not using prelinking since the last run."

We run here a (new) CentOS 7 system. To observe the system against invalid changes / hacker attacks we running rkhunter every night. Also after each (yum) update we prelinking all and running "...
  • 949
1 vote
0 answers
389 views

Nginx uses another ports rather than tcp 80 and 443

Rkhunter shows that nginx uses two UDP ports rather than 80 and 443 which I have of course enabled, but not those which rkhunter shows as hidden ports: [12:56:58] Checking for hidden ports ...
  • 83
0 votes
1 answer
2k views

rkhunter - deleted files - whitelist issues

I am working to secure a fresh Debian LAMP deployment and decided to include rkhunter (v1.4.2) in my security solution. I have run it using the following options: rkhunter -c --enable all --disable ...
  • 13
1 vote
1 answer
2k views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
2 votes
1 answer
466 views

RKHunter report: "No hash value found"

I'm getting RKHunter warnings every day when my cron job runs the check. I'm on FreeBSD 10.2 This is the warning I'm getting: Warning: No hash value found for file '/usr/bin/perl' in the 'rkhunter....
  • 313
2 votes
2 answers
786 views

Rkhunter reports openssl warning

I have installed and configured rkhunter on Centos and I have no warning except Checking version of OpenSSL [ Warning ] when I check log file I see that I need to update ...
  • 161
16 votes
3 answers
23k views

rkhunter: "Suspicious Shared Memory segments"

I have here a new installed server with CentOS7 and a GroupOffice installation on it. After installing rkhunter and starting a rkhunter check I get: [09:58:15] Suspicious Shared Memory segments [09:...
  • 949
0 votes
0 answers
493 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
  • 379
3 votes
1 answer
284 views

Is there any reference for current binary file checksums (Ubuntu 12.04 LTS)

I'm using rkhunter to check my system regularly - Sometimes rkhunter output some warnings on file changes (after update e.g.) rkhunter gives me the new file checksum and the old one, but is there any ...
  • 131
2 votes
1 answer
3k views

What to do if rkhunter finds a possible rootkit?

ran rkhunter tonight, and I got this for the results: [04:17:34] System checks summary [04:17:34] ===================== [04:17:34] [04:17:34] File properties checks... [04:17:34] Files checked: 133 [...
9 votes
4 answers
3k views

rkhunter warns of inode change but no file modification date changes

I have several systems running Centos 6 with rkhunter installed. I have a daily cron running rkhunter and reporting back via email. I very often get reports like: ---------------------- Start ...
  • 1,282
1 vote
4 answers
7k views

rkhunter warnings - whitelisting

I'm getting a set of warnings via rkhunter that I can't seem to suppress using ALLOWDEVFILE. Here's a piece of what gets flagged: Checking /dev for suspicious file types [ Warning ] Warning: ...
1 vote
2 answers
5k views

RKHunter reported processes that are using deleted files or are listening on the network

I ran Rootkit Hunter 1.4.0 on a Debian Wheezy server and I am confused by the output. I enabled every tests using the following piece of configuration: ENABLE_TESTS="all" DISABLE_TESTS="none" The ...
  • 183
0 votes
1 answer
454 views

Whitelisting session files with rkhunter

I am running a webserver and am saving PHP sessions to /dev/shm -- rkhunter is flagging the session files: Warning: Suspicious file types found in /dev: /dev/shm/...
2 votes
1 answer
367 views

RKHunter reports change in file properties, but different hash length

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash. [11:47:13] Warning: The file properties have changed: ...
  • 2,109
0 votes
1 answer
114 views

rkhunter warning message /bin/sh

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain. Warning: The file properties have changed: File: /bin/...
  • 1,132
1 vote
1 answer
267 views

Correct procedure for RKHunter file changes

I run RKHunter on Ubuntu as well as as automated system / package updates. Last night I started receiving RKHunter warnings as listed below and whilst it's obviously easy for me to just do: rkhunter -...
1 vote
1 answer
5k views

Rkhunter triggered last night warning for a possible infection. What next?

Last night rkhunter triggered with the following warnings: [04:10:23] Warning: Network TCP port 32982 is being used by /usr/lib/apache2/mpm-prefork/apache2. Possible rootkit: Solaris Wanuk ...
1 vote
1 answer
855 views

Using Nagios With RKhunter

I have installed rkhunter and would like the rootkit checks to be done automatically with alerts. How would i go about integrating RKhunter with nagios? One scenario would be if a root kit is found, i ...
0 votes
1 answer
728 views

How can I send remote emails using exim?

I'm on Debian I'm trying to send an email to email@gmail.com but it's not working although I changed the configtype in update-exim4.conf.conf to "internet". It doesn't give me any output but I can't ...
  • 125
2 votes
2 answers
152 views

Single file changed: intrusion or corruption?

rkhunter reported a single file change on a virtual server (netstat binary). It didn't report any other warning. The change was not the result of a package upgrade (I reinstalled it and the checksum ...
1 vote
4 answers
4k views

Crontab and rkhunter Scheduling

I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter. Every day at 7pm EST the rkhunter script is ...
7 votes
3 answers
5k views

Rkhunter reports file properties have changed

I am running a fully updated LTS copy of Ubuntu server. Today I ran rkhunter (as I do from time to time). This is the output I got: Warning: The file properties have changed: [15:52:25] ...
1 vote
1 answer
1k views

Can someone explain this rkhunter report?

This is my rkhunter output that I recently set so I get this report every morning, could somone please explain if I have a serious problem here (I know about httpd, openssl, php and sshd not up to ...
  • 787
9 votes
1 answer
5k views

rkhunter error message, how to fix?

I am receiving the following errors from rkhunter. I have recently upgraded my server from lenny to squeeze and this may have caused the problem. How do I fix this or hide the error messages? Warning:...
0 votes
1 answer
917 views

rkhunter warnings

Ran rkhunter (centos, cpanel box) /usr/bin/groups [ Warning ] /usr/bin/whatis [ Warning ] /usr/bin/ldd ...
0 votes
2 answers
1k views

rkhunter warning messages

i performed rkhunter -c on my server, and i get warnings for following files: /bin/GET /bin/wget /usr/local/bin/rkhunter Performing trojan specific checks Checking for enabled xinetd services ...
  • 863
1 vote
2 answers
2k views

rkhunter reports change in file properties, but I don't see that they've been updated by yum

Maybe I'm being overcautious, but I recently received the following warnings from rkhunter: Warning: The file properties have changed: File: /bin/dmesg Current hash: ...
2 votes
3 answers
1k views

Yum install problems

I'm trying to install rkhunter via yum on CentOS 4.8, but it's just not happening... Loading "fastestmirror" plugin Setting up Install Process Setting up repositories update 100% |=...
  • 287