LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   chkrootkit warning - anything to be worried about? (https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-warning-anything-to-be-worried-about-4175458202/)

eponymous 04-15-2013 10:07 AM
chkrootkit warning - anything to be worried about?
 
Hi,

I've just installed chkrootkit and I'm not sure how to intepret the following (I've removed the rest as it looked fine):

Code:
Checking `chkutmp'...  The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! <user>      1**** pts/0  /usr/bin/ssh -oForwardX11 no -oForwardAgent no -oClearAllForwardings yes -oProtocol 2 -oNoHostAuthenticationForLocalhost yes -l <another_user> -s <hostname> sftp
Note: I've masked out the two users in question along with the hostname.

I connect to the above SFTP server using Gigolo in Xfce. When I "Disconnect" the share, the above message goes away. I don't understand why it is there when I connect to the host however.

Is this something to be concered about?

unSpawn 04-15-2013 12:27 PM
The process is attached to a tty but no audit record was found in /var/run/utmp. Normal behaviour for processes that wait for a login to occur. Also note the chance of having only chkutmp tty warnings point to a compromise may be considered almost nonexistent.

eponymous 04-16-2013 05:25 AM
Thanks for your reply.

I also have this message:

net0: PF_PACKET(/var/tmp/portage/net-misc/dhcp-4.2.5_p1/image/sbin/dhclient (deleted))

Do you know what it means?

I'm having trouble finding documentation on how to interpret chkrootkit results...

unSpawn 04-16-2013 01:24 PM
Quote:
Originally Posted by eponymous (Post 4932310)
net0: PF_PACKET(/var/tmp/portage/net-misc/dhcp-4.2.5_p1/image/sbin/dhclient (deleted))
Do you know what it means?
See http://www.linuxquestions.org/questi...8/#post4535586 ?

eponymous 04-17-2013 09:44 AM
Hmm, that seems similar but my message states that the file is deleted. Does that have any significance?

unSpawn 04-18-2013 01:27 AM
Ask yourself what the /var/tmp/portage directory is used for.

eponymous 04-18-2013 07:21 AM
It is used for unpacking source code as an area to compile whatever you are emerging. I do expect it to be cleared out from time to time but what I don't know is why chkrootkit is referring to deleted files.

unSpawn 04-20-2013 04:00 AM
Quote:
Originally Posted by eponymous (Post 4933991)
It is used for unpacking source code as an area to compile whatever you are emerging. I do expect it to be cleared out from time to time but what I don't know is why chkrootkit is referring to deleted files.
Clearly there's a difference between expecting something and something actually happening ;-p A process may be started, remaining running in memory, and then have its files removed, is the answer.


All times are GMT -5. The time now is 09:38 AM.