Usando o Rkhunter

Iniciado por Holmes, 24 de Março de 2010, 20:10

tópico anterior - próximo tópico

Holmes

Oi pessoal do fórum,

Atualmente uso o Ubuntu Netbook Remix 9.10 e hoje rodei o Rkhunter e apareceram alguns  "Warning". Veja o resultado do escaneamento:

===============================================
   /usr/bin/dpkg                                            [ Warning ]
   /usr/bin/dpkg-query                                      [ Warning ]
       /usr/bin/ldd                                             [ Warning ]
       /usr/bin/sudo                                            [ Warning ]
       /sbin/init                                               [ Warning ]
       /sbin/runlevel                                           [ Warning ]
       /usr/sbin/rsyslogd                                       [ Warning ]
   
 Performing filesystem checks
   Checking /dev for suspicious file types                  [ Warning ]
   Checking for hidden files and directories                [ Warning ]

   Checking version of Exim MTA                             [ Warning ]
   Checking version of GnuPG                                [ Warning ]
   Checking version of OpenSSL                              [ Warning ]

======================================================

Será que esses avisos são perigosos? O que vcs acham?

Vlw, Viva 8)
EeePC 1008ha - Chakra Linux (Edn) - KDE 4.7.4 - Kernel 3.1.
- Meu Blog: http://holmeslinux.blogspot.com/
- Fundador do Chakra Brasil: http://chakra-linux.com.br/forum

dtomadon

Vou reativar esse tópico, instalei e rodei o rkhunter pelo que entendi está tudo ok , mas aparece uns warning como o do colega

que criou o tópico, alguém pode nos dar uma explicação??

Segue o final do /var/log/rkhunter do meu sistema

Info: Starting test name 'filesystem'
[17:32:28] Info: SCAN_MODE_DEV set to 'THOROUGH'
[17:32:28]   Checking /dev for suspicious file types         [ Warning ]
[17:32:28] Warning: Suspicious file types found in /dev:
[17:32:28]          /dev/shm/pulse-shm-2046226088: data
[17:32:28]          /dev/shm/pulse-shm-1757096289: data
[17:32:28]          /dev/shm/pulse-shm-2206134920: data
[17:32:28]          /dev/shm/pulse-shm-1659829559: data
[17:32:28]          /dev/shm/pulse-shm-2686290688: data
[17:32:28]          /dev/shm/pulse-shm-4237282487: data
[17:32:28]          /dev/shm/pulse-shm-2413546283: data
[17:32:28]          /dev/shm/pulse-shm-2334818578: data
[17:32:28]          /dev/shm/pulse-shm-2817242325: data
[17:32:28]          /dev/shm/pulse-shm-2677046059: data
[17:32:28]          /dev/shm/pulse-shm-1254605091: data
[17:32:28]          /dev/shm/pulse-shm-479002768: data
[17:32:28]          /dev/shm/pulse-shm-244241530: data
[17:32:29]   Checking for hidden files and directories       [ Warning ]
[17:32:29] Warning: Hidden directory found: /etc/.java
[17:32:29] Warning: Hidden directory found: /dev/.udev
[17:32:29] Warning: Hidden directory found: /dev/.initramfs
[17:32:39]
[17:32:39] Info: Test 'apps' disabled at users request.
[17:32:39]
[17:32:39] System checks summary
[17:32:39] =====================
[17:32:39]
[17:32:39] File properties checks...
[17:32:39] Files checked: 133
[17:32:39] Suspect files: 0
[17:32:39]
[17:32:39] Rootkit checks...
[17:32:39] Rootkits checked : 245
[17:32:39] Possible rootkits: 0
[17:32:39]
[17:32:39] Applications checks...
[17:32:39] All checks skipped
[17:32:39]
[17:32:39] The system checks took: 1 minute and 45 seconds
[17:32:40]
[17:32:40] Info: End date is Dom Jul 11 17:32:40 BRT 2010
BacKTrack5 64 bits com Vídeo SIS

kernel omnislash 1.4.4 64 bits , Que venha o 5º Semestre !!!