Newsgroup: it.comp.os.linux.iniziare
Titolo: Log rkhunter Aiuto

Questo ï¿œ l'estratto del log generato da rkhunter, come potrete vedere ci sono
delle criticitï¿œ, purtroppo non sono in grado di comprenderle, chiedo quindi il
vostro aiuto e nel caso ravvisaste delle "infezioni?" dei consigli su come
rimediare.
L'unica cosa che ho compreso un pochino riguarda openssl, mi dice che ï¿œ out of
time, ma secondo synaptic ï¿œ aggiornato.
Grazie.
[20:33:03] Running Rootkit Hunter version 1.3.4 on alessandro-laptop
[20:33:03]
[20:33:03] Info: Start date is ven mag  7 20:33:03 CEST 2010
[20:33:03]
[20:33:03] Checking configuration file and command-line options...
[20:33:03] Info: Detected operating system is 'Linux'
[20:33:03] Info: Found O/S name: Linux Mint 8 Helena - Main Edition
[20:33:03] Info: Command line is /usr/bin/rkhunter -c
[20:33:12] Performing 'shared libraries' checks
[20:33:12] Info: Starting test name 'shared_libs'
[20:33:12] Checking for preloading variables                 [ None found ]
[20:33:12] Checking for preload file                         [ Not found ]
[20:33:12] Info: Starting test name 'shared_libs_path'
[20:33:12] Checking LD_LIBRARY_PATH variable                 [ Not found ]
[20:33:12]
[20:33:12] Performing file properties checks
[20:33:12] Info: Starting test name 'properties'
[20:33:12] Checking for prerequisites                        [ OK ]
[20:33:23] /usr/bin/dpkg                                     [ Warning ]
[20:33:24] Warning: The file properties have changed:
[20:33:24]          File: /usr/bin/dpkg
[20:33:24]          Current hash: 53d7c6c257b70f354bcf6d1cddd171180b24e8d0
[20:33:24]          Stored hash : 53e46099fb111f5909e9a6a4be154f11f1743d4c
[20:33:24]          Current inode: 33157    Stored inode: 32945
[20:33:24]          Current size: 391920    Stored size: 412400
[20:33:24]          Current file modification time: 1268271142
[20:33:24]          Stored file modification time : 1253435026
[20:33:24] /usr/bin/dpkg-query                               [ Warning ]
[20:33:24] Warning: The file properties have changed:
[20:33:24]          File: /usr/bin/dpkg-query
[20:33:24]          Current hash: e3fa9c39564c1860bd7d86f7005a90ef8da821a2
[20:33:24]          Stored hash : 1d9ca0bf53cdc2ab56850192c86ad17b863d58d9
[20:33:24]          Current inode: 34565    Stored inode: 32948
[20:33:24]          Current size: 96172    Stored size: 104420
[20:33:24]          Current file modification time: 1268271142
[20:33:25]          Stored file modification time : 1253435026
[20:33:27] /usr/bin/ldd                                      [ Warning ]
[20:33:27] Warning: The file properties have changed:
[20:33:27]          File: /usr/bin/ldd
[20:33:28]          Current inode: 34734    Stored inode: 33343
[20:33:28]          Current file modification time: 1262524712
[20:33:28]          Stored file modification time : 1254905399
[20:33:28] Info: Found file '/usr/bin/ldd': it is whitelisted for the 'script
replacement' check.
[20:33:33] /usr/bin/sudo                                     [ Warning ]
[20:33:33] Warning: The file properties have changed:
[20:33:33]          File: /usr/bin/sudo
[20:33:33]          Current hash: daa60130c30c5df58e10e6d280fd9dfcb5673ecf
[20:33:33]          Stored hash : 355d1fadf50704e5c47b3072fb95f4eed83c3669
[20:33:33]          Current permissions: 04755    Stored permissions: 06755
[20:33:33]          Current inode: 33459    Stored inode: 33881
[20:33:33]          Current size: 123504    Stored size: 123448
[20:33:33]          Current file modification time: 1271179871
[20:33:33]          Stored file modification time : 1245687262
[20:33:39] /sbin/ifdown                                      [ Warning ]
[20:33:39] Warning: The file properties have changed:
[20:33:39]          File: /sbin/ifdown
[20:33:39]          Current hash: 9b09364c44c8d6891c6e7bee14943b280bf10cc8
[20:33:39]          Stored hash : 59b6b8df01abc4004a13dec4f174c7c3715dc6c7
[20:33:39]          Current inode: 1757862    Stored inode: 1757894
[20:33:39]          Current size: 34692    Stored size: 38844
[20:33:39]          Current file modification time: 1266866128
[20:33:40]          Stored file modification time : 1253661804
[20:33:40] /sbin/ifup                                        [ Warning ]
[20:33:40] Warning: The file properties have changed:
[20:33:40]          File: /sbin/ifup
[20:33:40]          Current hash: 9b09364c44c8d6891c6e7bee14943b280bf10cc8
[20:33:40]          Stored hash : 59b6b8df01abc4004a13dec4f174c7c3715dc6c7
[20:33:40]          Current inode: 1757862    Stored inode: 1757895
[20:33:40]          Current size: 34692    Stored size: 38844
[20:33:40]          Current file modification time: 1266866128
[20:33:40]          Stored file modification time : 1253661804
[20:33:40] /sbin/init                                        [ Warning ]
[20:33:40] Warning: The file properties have changed:
[20:33:40]          File: /sbin/init
[20:33:40]          Current inode: 1757958    Stored inode: 1757896
[20:33:40]          Current file modification time: 1260461982
[20:33:41]          Stored file modification time : 1255634324
[20:33:43] /sbin/runlevel                                    [ Warning ]
[20:33:43] Warning: The file properties have changed:
[20:33:43]          File: /sbin/runlevel
[20:33:43]          Current inode: 1758009    Stored inode: 1757988
[20:33:43]          Current file modification time: 1260461982
[20:33:43]          Stored file modification time : 1255634324
[20:33:47] /usr/sbin/rsyslogd                                [ Warning ]
[20:33:47] Warning: The file properties have changed:
[20:33:47]          File: /usr/sbin/rsyslogd
[20:33:47]          Current inode: 36390    Stored inode: 35692
[20:33:47]          Current file modification time: 1257420918
[20:33:47]          Stored file modification time : 1255580956
[20:33:48] /usr/sbin/unhide                                  [ Warning ]
[20:33:48] Warning: The file '/usr/sbin/unhide' exists on the system, but it is
not present in the rkhunter.dat file.
[20:33:49] /usr/sbin/unhide-linux26                          [ Warning ]
[20:33:49] Warning: The file '/usr/sbin/unhide-linux26' exists on the system,
but it is not present in the rkhunter.dat file.
[20:34:44]     Running skdet command                         [ Skipped ]
[20:34:44] Info: Unable to find the 'skdet' command
[20:34:52]   Checking for software intrusions                [ Skipped ]
[20:34:52] Info: Check skipped - tripwire not installed
[20:34:53]   Performing check for enabled xinetd services
[20:34:53]   Checking for enabled xinetd services            [ Skipped ]
[20:34:53] Info: Check skipped - file '/etc/xinetd.conf' does not exist.
[20:34:53] Info: Apache backdoor check skipped: Apache modules and configuration
directories not found.
[20:35:13] Performing filesystem checks
[20:35:13] Info: Starting test name 'filesystem'
[20:35:13] Info: SCAN_MODE_DEV set to 'THOROUGH'
[20:35:14]   Checking /dev for suspicious file types         [ Warning ]
[20:35:14] Warning: Suspicious file types found in /dev:
[20:35:14]          /dev/shm/pulse-shm-2213044181: data
[20:35:14]          /dev/shm/pulse-shm-194998333: data
[20:35:14]          /dev/shm/mono.2661: data
[20:35:14]          /dev/shm/pulse-shm-721924093: data
[20:35:14]          /dev/shm/pulse-shm-
2565427934
: data
[20:35:14]          /dev/shm/ecryptfs-alessandro-Private: ASCII text
[20:35:15]          /dev/shm/pulse-shm-351570152: data
[20:35:15]   Checking for hidden files and directories       [ Warning ]
[20:35:15] Warning: Hidden directory found: /etc/.java
[20:35:15] Warning: Hidden directory found: /dev/.udev
[20:35:15] Warning: Hidden directory found: /dev/.initramfs
[20:35:26]
[20:35:26] Checking application versions...
[20:35:26] Info: Starting test name 'apps'
[20:35:27]   Checking version of Exim MTA                    [ Warning ]
[20:35:27] Warning: Application 'exim', version '4.69', is out of date, and
possibly a security risk.
[20:35:27]   Checking version of GnuPG                       [ Warning ]
[20:35:27] Warning: Application 'gpg', version '1.4.9', is out of date, and
possibly a security risk.
[20:35:27] Info: Application 'httpd' not found.
[20:35:28] Info: Application 'named' not found.
[20:35:28]   Checking version of OpenSSL                     [ Warning ]
[20:35:28] Warning: Application 'openssl', version '0.9.8g', is out of date, and
possibly a security risk.
[20:35:28] Info: Application 'php' not found.
[20:35:28] Info: Application 'procmail' not found.
[20:35:28] Info: Application 'proftpd' not found.
[20:35:28] Info: Application 'sshd' not found.
[20:35:28] Info: Applications checked: 3 out of 9
[20:35:28]
[20:35:28] System checks summary
[20:35:28] =====================
[20:35:28]
[20:35:28] File properties checks...
[20:35:28] Files checked: 129
[20:35:28] Suspect files: 11
[20:35:28]
[20:35:28] Rootkit checks...
[20:35:28] Rootkits checked : 111
[20:35:28] Possible rootkits: 0
[20:35:28]
[20:35:28] Applications checks...
[20:35:28] Applications checked: 3
[20:35:29] Suspect applications: 3

 
rkhunter è conosciuto per essere poco affidabile in quanto prono a falsi 
positivi
S.

 S.
Consigli ?

 aiuto
Al 99,99% nessun problema: hai solo installato e aggiornato qualcosa.
Rkhunter fa diverse cose, una di queste è verificare che certi file
non siano cambiati dall'ultimo controllo. Naturalmente, se sei stato
tu ad aggiornare, il cambiamento è giustificato.
(Subito) dopo un aggiornamento o dopo una installazione di software -
la responsabilità di farlo da fonti sicure è tutta tua, naturalmente -
esegui:
# rkhunter --propupd
Vedi il man pei dettagli.
-- 
Bye, Lem
Ceterum censeo ISLAM esse delendum
____________________________________________________________________________
Non sprecare i cicli idle della tua CPU: 
http://boinc.berkeley.edu/index.php