rkhunter displaying warning message

Michael_aust · 04-27-2006, 01:05 PM

I ran rkhunter today and the following came up:

Code:

System checks
* Allround tests
   Checking hostname... Found. Hostname is debian
   Checking for passwordless user accounts... OK
   Checking for differences in user accounts... Found differences
   Info:
----------------------
< hsqldb:x:104:103:HSQLDB system user,,,:/var/lib/hsqldb:/bin/bash
----------------------
   Info: Some items have been added (items marked with '<')
   Checking for differences in user groups... Found differences
   Info:
----------------------
< hsqldb:x:103:
----------------------
   Info: Some items have been added (items marked with '<')
   Checking boot.local/rc.local file...
     - /etc/rc.local                                          [ Not found ]
     - /etc/rc.d/rc.local                                     [ Not found ]
     - /usr/local/etc/rc.local                                [ Not found ]
     - /usr/local/etc/rc.d/rc.local                           [ Not found ]
     - /etc/conf.d/local.start                                [ Not found ]
     - /etc/init.d/boot.local                                 [ Not found ]
   Checking rc.d files...                                     [ Not found ]
   Checking history files
     Bourne Shell                                             [ OK ]

* Filesystem checks
   Checking /dev for suspicious files...                      [ OK ]
   Scanning for hidden files...                               [ Warning! ]
---------------

Could anyone tell me if this is anything to worry about or not, the 'found differences' were red. Everything else siad it was clean or ok. The scan summary said everything was ok. So what does the above mean?

Thanks in advance

Michael

Mara · 04-27-2006, 02:40 PM

The messages mean that there's new user and new group. You have the accounts listed. If that's what you have added yourself, that's OK.

Michael_aust · 04-27-2006, 03:13 PM

well as far as I kno I havent added any users or new groups. From looking at kuser I have the following useres:

Code:

root
daemon
bin
sys
sync
games
man
lp
mail
uucp
proxy
www-data
backup
list
irc
gnats
Debian-exim
identd
messagebus
hal
hsqldb
house (thats me)
nobody

These are the groups kuser shows I have

Code:

root
daemon
bin
sys
adm
tty
disk
lp
mail
news
uucp
man
proxy
kmem
dialout
fax
voice
cdrom
floppy
tape
sudo
audio
dip
www-data
backup
operator
list
irc
src
gnats
shadow
utmp
video
sasl
plugdev
staff
games
users
crontab
Debian-exim
hsqldb
messagebus
hal
powerdev
camera
scanner
house (thats me)
nogroup

does anything there look out of place or that i should not be there. I have no idea what im supposed to be looking for here sorry.

Michael_aust · 04-27-2006, 03:17 PM

i have a feeling it may be hsqldb as it says its password was last changed today while all the oehters were last changed on the 19th of april and i did install libhsqldb-server today.

Could this be it?

Mara · 04-30-2006, 05:24 PM

Yes, absolutely.