Author Topic: rkhunter update & new warning  (Read 1777 times)

Offline Almost-retired

  • Sr. Member
  • ****
  • Posts: 252
    • What keeps Gene out of the bars
rkhunter update & new warning
« on: March 16, 2011, 05:24:56 AM »
Greetings all;

rkhunter has been complaining that its network references were un-available, more often than not recently, so I went hunting on the net & found I was from the repo's 1.3.4 to 1.3.8 out of date.

So I grabbed the tarball and installed 1.3.8,  discovering the executibles have been moved but thats nothing new.  Fixed that in /etc/cron.daily/rkhunter and then I could get the right version returned again.

But, its output now contains a new warning:
 [root@coyote cron.daily]# ./rkhunter
Warning: Checking for possible rootkit strings    [ Warning ]
         Found string 'hdparm' in file '/etc/rc.d/rc.sysinit'. Possible rootkit: Xzibit Rootkit
Warning: Application 'httpd', version '2.2.16', is out of date, and possibly a security risk.

The httpd 2.2.16 I have meowed about before, and I do use it here as my web page is actually on this machine, and if a security hole exists, I would appreciate that being updated.

But the hdparm warning about Xzibit is a new one.  This one came from the pclos repo, so maybe it bears a closer look?

Thanks everybody.

Cheers, Gene

Offline Texstar

  • Administrator
  • Super Villain
  • *****
  • Posts: 12495
Re: rkhunter update & new warning
« Reply #1 on: March 16, 2011, 10:22:03 AM »
rkhunter is mainly designed to make busy work for people coming from Windows as they don't have anything to do and get bored unless they are scanning for something.

Now hdparm is supposed to be in rc.sysinit. It sets up your harddrive optimization

# Turn on harddisk optimization
# There is only one file /etc/sysconfig/harddisks for all disks
# after installing the hdparm-RPM. If you need different hdparm parameters
# for each of your disks, copy /etc/sysconfig/harddisks to
# /etc/sysconfig/harddiskhda (hdb, hdc...) and modify it.
# Each disk which has no special parameters will use the defaults.
# Each non-disk which has no special parameters will be ignored.
#
 
disk[0]=s;
disk[1]=hda;   disk[2]=hdb;   disk[3]=hdc;   disk[4]=hdd;
disk[5]=hde;   disk[6]=hdf;   disk[7]=hdg;   disk[8]=hdh;
disk[9]=hdi;   disk[10]=hdj;  disk[11]=hdk;  disk[12]=hdl;
disk[13]=hdm;  disk[14]=hdn;  disk[15]=hdo;  disk[16]=hdp;
disk[17]=hdq;  disk[18]=hdr;  disk[19]=hds;  disk[20]=hdt;
disk[21]=sda;  disk[22]=sdb;  disk[23]=sdc;  disk[24]=sdd;
disk[25]=sde;  disk[26]=sdf;  disk[27]=sdg;  disk[28]=sdh;
disk[29]=sr0;  disk[30]=sr1;  disk[31]=sr2;  disk[32]=sr3;
disk[33]=scd0; disk[34]=scd1; disk[35]=scd2; disk[36]=scd3;
disk[37]=sg0;  disk[38]=sg1;  disk[39]=sg2;  disk[40]=sg3;

etc...

httpd is ok too because even though it is an older stable version, it is properly maintained.

Thanks to everyone who donates. You keep the servers running.

Offline Almost-retired

  • Sr. Member
  • ****
  • Posts: 252
    • What keeps Gene out of the bars
Re: rkhunter update & new warning
« Reply #2 on: March 16, 2011, 07:42:14 PM »
I did have to ask.  Their reference site having such a poor up time isn't exactly impressive.

Thanks & Cheers, Gene

Offline kjpetrie

  • PCLinuxOS Tester
  • Hero Member
  • *******
  • Posts: 3979
Re: rkhunter update & new warning
« Reply #3 on: March 17, 2011, 05:47:03 AM »
When I first came to this forum the consensus advice seemed to be that rkhunter was needed to safeguard the system against the one form of attack that was likely.

Am I to understand this is not true?
-----------
KJP
-----------------------------------------------------------
PClos64 RC1 on Intel D945GCLF2 motherboard (Atom 330), 2GB DDR2 RAM, Maxtor STM325031, HL-DT-ST DVDRAM GSA-H42N, Amilo LSL 3220T monitor. Also Acer 5810TG (with custom kernel) and Asus eeePC 2G surf

Offline AndrzejL

  • PCLinuxOS Tester
  • Super Villain
  • *******
  • Posts: 12791
  • RLU #490933
    • Wordpress On The Wardrobe...
Re: rkhunter update & new warning
« Reply #4 on: March 17, 2011, 06:55:23 AM »
I did have to ask.  Their reference site having such a poor up time isn't exactly impressive.

Thanks & Cheers, Gene

To late... You have hurt Texstar's feelings trusting some rootkit hunting software over his H4X00r skill... As a punishment please donate Your entire paycheck this week and beg for forgiveness :D LOL!!! Did I said that right Boss? :D

Andy

Offline Almost-retired

  • Sr. Member
  • ****
  • Posts: 252
    • What keeps Gene out of the bars
Re: rkhunter update & new warning
« Reply #5 on: March 17, 2011, 07:52:13 AM »
Aww, Gee.  I sure didn't wanna do that.  But I'm afraid my paycheck, if you want to call SS a paycheck, is so small I couldn't afford to lose it.  Besides, I already made a donation & got the PASS working because I do believe in supporting a distro that mostly works.  Yeah, I'm an old fart, & if I'm still here come October, I will have made 77 trips around this star.  That, and a buck and a half, will get you a good sized cup of coffee to go at the nearest 7-11.  ;-)  But I am not the oldest linux user, I ran into a gent 2 years older on the emc mailing list a week ago.

I am however, looking for a T-shirt that says "Yes, I'm a Senior Citizen, now give me the damned discount", and a good pattern for both sides of a coin so I can carve on my toy milling machine, me and a few friends, a few 'round tuit's.  How many core contributors to pclos are there, I might send a small box of them to Texstar to pass out.  Stuff like that keeps me out of thee bars.

Thanks & Cheers, Gene

Offline Was_Just19

  • Hero Member
  • *****
  • Posts: 6852
  • MLU
Re: rkhunter update & new warning
« Reply #6 on: March 17, 2011, 09:55:39 AM »
Quote
Stuff like that keeps me out of thee bars.

I feel certain the other bar owners appreciate your custom!


 ;D ;D ;D

Offline Neal ManBear

  • Administrator
  • Super Villain
  • *****
  • Posts: 15845
  • LXDE! Coffee, Bacon and Cheesecake!
Re: rkhunter update & new warning
« Reply #7 on: March 17, 2011, 10:39:57 AM »
Aww, Gee.  I sure didn't wanna do that.  But I'm afraid my paycheck, if you want to call SS a paycheck, is so small I couldn't afford to lose it.  Besides, I already made a donation & got the PASS working because I do believe in supporting a distro that mostly works.  Yeah, I'm an old fart, & if I'm still here come October, I will have made 77 trips around this star.  That, and a buck and a half, will get you a good sized cup of coffee to go at the nearest 7-11.  ;-)  But I am not the oldest linux user, I ran into a gent 2 years older on the emc mailing list a week ago.

I am however, looking for a T-shirt that says "Yes, I'm a Senior Citizen, now give me the damned discount", and a good pattern for both sides of a coin so I can carve on my toy milling machine, me and a few friends, a few 'round tuit's.  How many core contributors to pclos are there, I might send a small box of them to Texstar to pass out.  Stuff like that keeps me out of thee bars.

Thanks & Cheers, Gene


I had this lying around:


Offline Almost-retired

  • Sr. Member
  • ****
  • Posts: 252
    • What keeps Gene out of the bars
Re: rkhunter update & new warning
« Reply #8 on: March 17, 2011, 11:49:04 AM »
That would do for one side & maybe I could inkscape something for the other side.  Have you got that in genuine high resolution?  Something I can run through potrace?  If so, email gheskett at wdtv dot com.

Thanks & Cheers,  Neal

Offline Neal ManBear

  • Administrator
  • Super Villain
  • *****
  • Posts: 15845
  • LXDE! Coffee, Bacon and Cheesecake!
Re: rkhunter update & new warning
« Reply #9 on: March 17, 2011, 12:00:55 PM »
That would do for one side & maybe I could inkscape something for the other side.  Have you got that in genuine high resolution?  Something I can run through potrace?  If so, email gheskett at wdtv dot com.

Thanks & Cheers,  Neal

That's all I have. I created it to pass on to someone back in December 2010. I could probably do a set, if you want. What would you want on the other side?

Offline Almost-retired

  • Sr. Member
  • ****
  • Posts: 252
    • What keeps Gene out of the bars
Re: rkhunter update & new warning
« Reply #10 on: March 17, 2011, 12:16:48 PM »
Gee, I dunno.  At one point of the Pet Rock craze back in the late 70's, one girl had one on her desk that said 'turn me over', so I did.  The other side said 'That felt good'.  If I could wrap that around the edge, repeated to fill the edge, it might be a little more unique.  At the time I considered asking her if she needed turned over, but then considered that she was a 200 lb dumb blond & 20 years younger, and left that offer unsaid. Way too much teen aged baggage on display. ;-)

Thanks & Cheers Neal, Gene

Offline Neal ManBear

  • Administrator
  • Super Villain
  • *****
  • Posts: 15845
  • LXDE! Coffee, Bacon and Cheesecake!
Re: rkhunter update & new warning
« Reply #11 on: March 17, 2011, 12:18:49 PM »
Gee, I dunno.  At one point of the Pet Rock craze back in the late 70's, one girl had one on her desk that said 'turn me over', so I did.  The other side said 'That felt good'.  If I could wrap that around the edge, repeated to fill the edge, it might be a little more unique.  At the time I considered asking her if she needed turned over, but then considered that she was a 200 lb dumb blond & 20 years younger, and left that offer unsaid. Way too much teen aged baggage on display. ;-)

Thanks & Cheers Neal, Gene

It sounds like you need a better graphics artist than I am.

Offline Wildman

  • PCLinuxOS Tester
  • Hero Member
  • *******
  • Posts: 7551
  • Symphony for a Unstrung Tongue
Re: rkhunter update & new warning
« Reply #12 on: March 17, 2011, 12:19:28 PM »
Tex has feelings??  Now that's a new one.....never sleeps, all ways at work on the software, answers questions and makes funnies in the forum,and still has feelings too..?? ??? ???
hummm, might not want to ask Which ones!!  :) :D ;D ;D
Now where's my German WW2 motorcycle helmet, I likely will need it to prevent the head blows from hurting.
Happiness is not having what you want, but wanting what you have!

Joe Gable, "Joble" Was my Friend..
Dave "Exwintech" has also gone on...
Linux Counter #288984

Offline Almost-retired

  • Sr. Member
  • ****
  • Posts: 252
    • What keeps Gene out of the bars
Re: rkhunter update & new warning
« Reply #13 on: March 17, 2011, 12:38:31 PM »
Neal, that's what I'm afraid of.  I think I'm going to have to bite the bullet & learn inkscape.  Probably right after I get the entertainment center I'm building for the neighbors delivered.  That is turning into a bigger project than I envisioned as I just now made a 1"x10"x4" alu bar and bolted it to the face of the head on my milling machine, with the intention of hanging a die grinder with a router bit in it on the far end, so it hangs out over the edge of the mills table and I can then cnc carve the tenons on the end of a stick to make a mortise and tenon joint that fits exactly every time.

Fred, of course, we all have feelings.  What bothers me is that all work and no play burns out the person too soon, which I would rather didn't happen to Texstar.

I am very familiar with that scene, having spent 40 years in tv engineering, where it doesn't matter what time of the day or night, when the phone rings, you roll, even if its a 3 day trip one way across 4 states just to get to the problem.  Trying to retire, but 9 years later my phone still rings occasionally.  Its a small supplemental income of course.

Thanks you two, & Cheers

Offline Neal ManBear

  • Administrator
  • Super Villain
  • *****
  • Posts: 15845
  • LXDE! Coffee, Bacon and Cheesecake!
Re: rkhunter update & new warning
« Reply #14 on: March 17, 2011, 12:47:35 PM »
Neal, that's what I'm afraid of.  I think I'm going to have to bite the bullet & learn inkscape.  Probably right after I get the entertainment center I'm building for the neighbors delivered.  That is turning into a bigger project than I envisioned as I just now made a 1"x10"x4" alu bar and bolted it to the face of the head on my milling machine, with the intention of hanging a die grinder with a router bit in it on the far end, so it hangs out over the edge of the mills table and I can then cnc carve the tenons on the end of a stick to make a mortise and tenon joint that fits exactly every time.

IMO learning graphics for yourself is always a great solution. :)

Quote
Fred, of course, we all have feelings.  What bothers me is that all work and no play burns out the person too soon, which I would rather didn't happen to Texstar.

Trust me. Texstar has fun. Me, too, for that matter. :)