121 replies to this topic

[Bruno]

Rootkit Hunter   Yesterday I was reading an Article on NewsForge by Joe Barr on "rkhunter" a new rootkit search program. ( and more ! ) So I went to the website http://www.rootkit.nl of the Dutch programmer who made the rkhunter and put it through the test on:  Mandrake 9.2 Mandrake 10 Vectorlinux 3.2 SOHO PCLos  Very nice program ! Does a lot more then "chkrootkit" the program we have been recommending up till now.  I reported back to Michael Boelen ( the maker ) that he could add MDK 10, PCLos and VectorLinux to the list on his site of Distro's where it was reported to work.  The only Distro I can not get it installed was Slackware . . . I need "Perl-Digest-SHA1" to make it install ( Did need that in both Mandrakes too, but found it on the CD ) . . . . but am unable to find it, nor on freshmeat, sourceforge, or the usual Slackpackages sites. Also Swaret did give no joy.  Anyway: I do recommend this program by my fellow citizen . . . Read Joe Barr on how to use it, and get the file ( rpm ) from the ftp   Bruno

[nlinecomputers]

Bookmarked.  I'll give a test drive.  Thanks for the link.

[Bruno]

You are welcome Nathan !!UPDATE: I found the Perl-Digest-SHA1 file for slackware ( well the source package in .tar.gz ):http://www.ultramonk...rl-Digest-SHA1/Unpacking is all you have to do :DB) Bruno

[trigggl]

Thanks for the link.  I'm thinking of going with broadband soon, so I definitely want my computer to be as secure as possible.  In Linux, a rootkit scanner is probably a lot more important than a virus scanner.I may even see if the AIX guys at work would care to use it.

[ross549]

Bruno,This might be a stupid question, but what does it do??Thanks

[Bruno]

Extra directions for Slackware:I unpacked rkhunter and the Perl-Digest-SHA1 in /usr/local/bin ( tar -zxvf ). . . then ran "/usr/local/bin/rkhunter/installer.sh" to install it . . . then made a symlink:

# ln -s /usr/local/bin/rkhunter/rkhunter /usr/bin/rkhunter

so it was in the "path"  . . . Now running:

# rkhunter -c --createlogfile

Does the job ! :DWow this is fun ! Bruno

[nlinecomputers]

It checks for rootkits.  Tools installed by hacker/cracker types to compromise your system.  This checks your system for common weak points such as world writable files or the presences of such rootkits on your system.  A good cracker will of course move to disable this but even that is a clue to you.  If you stop getting reports via email then something is wrong.  MSEC in Mandrake performs a simular function.  Also see Bastile.(sp?)

[Bruno]

ross549, on Apr 8 2004, 08:25 PM, said:

Bruno,This might be a stupid question, but what does it do??Thanks

Hi Adam . . it hunts for "rootkits" and unsafe files and unsafe permissions to files . . also unusual hidden files in / . . . does an MD5 check . . . and a lot more . . . :DJust read the Sites I liked you to the Joe Barr article is pretty clear . .  ( I thought it was ) Bruno

[Bruno]

The final results are that PCLos is safer then Mandrake ( In file permissions that is, though far from alarming ) . . and VectorLinux is safer then Slackware . . . The ranking is:1). VectorLinux2). Slackware3). PClos4). Mandrake 105). Mandrake 9.2 ( yep there is a difference between 9.2 and 10 )All systems passed the test, but I did get a few warnings on file permissions on the last 4 distros . . . also they said to check .aumixrc on the Drakes . . it is just a config file for the mixer settings so false alarm :DB) Bruno

[zox]

Thanks.You can never be secure enough.

[Bruno]

You''re welcome Zox . . . is a fun little program :DB) Bruno

[nlinecomputers]

Bruno, on Apr 8 2004, 02:41 PM, said:

The final results are that PCLos is safer then Mandrake ( In file permissions that is, though far from alarming ) . . and VectorLinux is safer then Slackware . . . The ranking is:1). VectorLinux2). Slackware3). PClos4). Mandrake 105). Mandrake 9.2 ( yep there is a difference between 9.2 and 10 )All systems passed the test, but I did get a few warnings on file permissions on the last 4 distros . . . also they said to check .aumixrc on the Drakes . . it is just a config file for the mixer settings so false alarm :DB) Bruno

Drakes file permissions depend on what setting MSEC is at.  Set it to paranoid and I bet alot of those warning go away.  Useabilty of the system suffers at that level as it is setup to be a VERY secure server.  So secure that you have to open holes in it to get to vital services.  Can't even logon as root at the console only via SSH or su.

[Bruno]

Hi NathanAll my test were done on a default install with default settings, but with securing along the lines in This thread.Because I am behind a hardware firewall, and not running a server my MSEC settings are set to default = "normal" . . I like the usabillity of my system too much to alter that ;) Bruno

[mhbell]

Problem Solved used the tarball instead of the rpmMel:D Anyone have any luck installing this in SuSE 9.0 ? I downloaded the rpm and went to install but there are some unmet dependencies in perl. I have the perl-digest sh-1 but don't have the MD5 or the perl Strict whatever that is. Also the sh-1 is not recognized by the program. checked my dvd installation source and install disk but no joy.   could not find them on SuSE FTP site either.Mel

[Bruno]

mhbell, on Apr 8 2004, 10:32 PM, said:

I have the perl-digest sh-1

Hi Mel . . is this a typo ?  . . . All I needed was "Perl-Digest-SHA1" and it included all the missing dependencies the installer of rkhunter showed before . . .  "Perl-Digest-SHA1" is available in many rpm's on the net: http://rpmfind.net/l.....ubmit=Search... Bruno

[mhbell]

Bruno, on Apr 8 2004, 02:39 PM, said:

mhbell, on Apr 8 2004, 10:32 PM, said:

I have the perl-digest sh-1

Hi Mel . . is this a typo ?  . . . All I needed was "Perl-Digest-SHA1" and it included all the missing dependencies the installer of rkhunter showed before . . .  "Perl-Digest-SHA1" is available in many rpm's on the net: http://rpmfind.net/l.....ubmit=Search... Bruno

You are right Bruno it is a typo. my Problem is solved I downloaded the Tarball and installed it and it met all dependencies and installed all of the necessary files. program runs great and my system is clean,   Of course I am also behind a hardware firewall too.   It appears that the RPM does not have all of the needed files.   I would suggest that anyone wanting to install the program to download and use the Tarball and not the RPM.       I am running SuSE 9.0 Pro for those who don't know so it works with it too.   Mel

[BarryB]

Well can add Mandrake 10 rc1 for AMD64 on the list of distro it works with..had 1 QT file it did like..but other than that,,we be cool..ummm secure

[SonicDragon]

Sounds like a great program! I can't wait to give it a try.Thanks for the extra slack directions Bruno!

[quint]

Thanks, Bruno! It also works great in "DaNix" (Debian-based).

[ross549]

Well, I installed it and ran on my system.... only came up with three alerts from what I could tell:

Need to check /etc/.aumixrcinfo: Users can use SSH1-protocolCannot find syslog/syslog-ng daemon

[linuxdude32]

Cool. Funny thing though, I get this error when I try to run the install script:

-bash: ./installer.sh: /bin/sh: bad interpreter: Permission denied

I checked permissions and paths and all appeared fine. Googled the entire error message and nothing came up and then googled just '/bin/sh: bad interpreter: Permission denied' and as usual the first result had the answer. My download partition was set to noexec and I had tried executing the script with only it's name (./installer.sh). Even though this solution wasn't suggested, I also found that running it like this worked, too:

sheridan:/home/jason/downloads/rkhunter # sh installer.sh

I LOVE Google! Very cool program. Found that I need to fix in my SSH config. Not a big deal since this machine blocks everything but some ports for DCC, but still good to know!

[Bruno]

ross549, on Apr 9 2004, 05:05 AM, said:

Well, I installed it and ran on my system.... only came up with three alerts from what I could tell:

Need to check /etc/.aumixrcinfo: Users can use SSH1-protocolCannot find syslog/syslog-ng daemon

Hi AdamThose messages are not unusual . . . let me try to shed some light:1). The /etc/.aumixrc file is mentioned because it is an hidden file outside of /home. Usually there are no hidden files outside /home ( also /root the "home" for root ).Have a look at the file ( cat /etc/.aumixrc ) and you will see that it are just the mixer settings

rkhunter, on site, said:

Although 'hidden' files can be usefull, sometimes they are an unwanted part of the system. By scanning for hidden files on places where they are not supposed to be (like in /tmp), we can track down some possible evil files.

2). The "Users can use SSH1-protocol" is very simple to fix:

# vi /etc/ssh/sshd_config

And either change the existing line "Protocol 2,1" to "Protocol 2" . . or if the line is completeely missing just add that line. This will solve the problem ( run rkhunter again and you will se that the line is gone )Read about it: http://lwn.net/2001/...fb-openssh.php33). "Cannot find syslog/syslog-ng daemon" . . . this is no real problem, because syslog is written to anyway . . . but if you want to read about "syslog:syslog-ng" go here:  http://www.linuxgaze.../scheidler.htmlGlad your system is secure Adam ! ;) Bruno

[Bruno]

BarryB, on Apr 9 2004, 12:46 AM, said:

Well can add Mandrake 10 rc1 for AMD64 on the list of distro it works with..had 1 QT file it did like..but other than that,,we be cool..ummm secure

Hi BarryI know about the QT files . . . it is because some of them are hidden files and rkhunter does not like that . . ( This goes mainly for the developpement libs of QT, if you have the full development kit for QT you will see a lot more of those ) . . . nothing to worry about, see "1)." of my answer to Adam here above ;) Bruno

[Bruno]

SonicDragon, on Apr 9 2004, 02:14 AM, said:

Sounds like a great program! I can't wait to give it a try.Thanks for the extra slack directions Bruno!

Hi Sonic . . . . . the Slacker Friends have a special place in my heart . . . . . . . . LOLB) Bruno

[Bruno]

quint, on Apr 9 2004, 04:04 AM, said:

Thanks, Bruno! It also works great in "DaNix" (Debian-based).

Hi QuintGlad to know it works for you too . . . will you send a report to Michael Boelen that he can add DaNix to the list of distos where rkhunter is reported to work ? Bruno