rkhunter (root kit hunter) warning

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I just installed rkhunter on this F7 machine
and am using the default config file (probably
a mistake.)
This morning I found this in my mail:

  Subject: [rkhunter] Warnings found for medulla
  Date: Mon, 18 Aug 2008 04:07:41 -0700 (PDT)

  Please inspect this machine, because it may be infected.

I've looked at the generated log and found nothing suspicious.  But
I'm not an experienced hunter and the log is >1000 lines long. I'd
like to post it here but I think it is too long for that.  Here is the
final summary:


[04:07:40] System checks summary
[04:07:40] =====================
[04:07:40]
[04:07:40] File properties checks...
[04:07:40] Required commands check failed
[04:07:40] Files checked: 129
[04:07:41] Suspect files: 0
[04:07:41]
[04:07:41] Rootkit checks...
[04:07:41] Rootkits checked : 64
[04:07:41] Possible rootkits: 0
[04:07:41]
[04:07:41] Applications checks...
[04:07:41] Applications checked: 5
[04:07:41] Suspect applications: 0
[04:07:41]
[04:07:41] The system checks took: 29 seconds
[04:07:41]
[04:07:41] Info: End date is Mon Aug 18 04:07:41 PDT 2008

The only thing that catches the eye is the "Required commands check
failed."  But a search for the words "failed" or "required" finds only
this line.

Lots of stuff was "skipped" in the log.  For example:

[04:07:35] Performing trojan specific checks
[04:07:35] Info: Starting test name 'trojans'
[04:07:36]   Checking for enabled inetd services             [ Skipped ]
[04:07:36] Info: Check skipped - file '/etc/inetd.conf' does not exist.

Indeed it doesn't.   I believe it has been replaced by /etc/xinetd.d/

This machine has iptables running on it is behind our
corporate firewall.  I'm not sure how to proceed.

Dean

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux