LinuxQuestions.org

Rootkit Hunter release 1.4.2

Posted 02-24-2014 at 01:26 PM by unSpawn

The Rootkit Hunter project team is pleased to announce the release of version 1.4.2.
Please see the rkhunter-1.4.2 download page for details.

unSpawn

Moderator

Posted in Uncategorized

Views 96 Comments 0 unSpawn is offline

Blocking lists of IP addresses using the iptables recent module or ipset and make fail2ban use it.

Posted 04-21-2013 at 07:25 AM by unSpawn
Updated 04-21-2013 at 08:34 AM by unSpawn (//Suggest saving the current rule set)

Tags fail2ban, ipset, iptables -m recent

To combat the common misconception that filling Netfilters filter table INPUT chain is still a valid choice, to show ease of use and for future reference I'll outline how to mass block IP(v4) addresses and how to integrate this in fail2ban.

*This web log post will not explain the fine print on ipset and iptables' {ipt,xt}_recent ('iptables -m recent --help'), nor will it tell you how to install anything, help you configure fail2ban, go into SysV vs BSD init scripts or application...

unSpawn

Moderator

Posted in Uncategorized

Views 1225 Comments 0 unSpawn is offline

Simple ClamAV sig for /lib64/libkeyutils.so.1.9 contents

Posted 02-16-2013 at 02:26 PM by unSpawn
Updated 02-17-2013 at 07:03 AM by unSpawn

Tags cve-2013-0871, libkeyutils.so.1.9, rkh, sshd, webhostingtalk

Wrt SSHD Rootkit Rolling around.

*I updated RKH in CVS but detection wasn't added yet to ClamAV, Securiteinfo or R-fx MLD:

Code:

]$ clamscan --official-db-only=no -d ./securiteinfoelf.hdb -d ./securiteinfosh.hdb -d ./rfxn.hdb -d ./rfxn.ndb -d ./RKH_libkeyutils.ldb -r --infected -r $PWD
path01/libkeyutils.so.1.9: RKH_libkeyutils.so.1.9.UNOFFICIAL FOUND
path02/libkeyutils.so.1.9: RKH_libkeyutils.so.1.9.UNOFFICIAL FOUND
path03/innucuoustarball.tar.bz2: RKH_libkeyutils.so.1.9.UNOFFICIAL

...

Attached Files

RKH_libkeyutils.ldb.txt (195 Bytes, 14 views)

unSpawn

Moderator

Posted in Uncategorized

Views 1526 Comments 0 unSpawn is offline

Bash logging patches

Posted 06-12-2012 at 12:25 PM by unSpawn

Tags audit trail, bash logging, bash patch, syslog

Over the years we've seen quite a few "I want to log everything" questions asked for which I listed some pointers a while ago in several posts. To complement a recent "I want to capture all the operations performed in the terminal" question (thread: How to Capture a Unix Terminal Session?) I looked for Bash patches. Long story short: Bash 4 can be compiled with syslog support but still that shell will run as the user who logs in AFAIK. (So depending on your requirements for coverage...

unSpawn

Moderator

Posted in Uncategorized

Views 1840 Comments 0 unSpawn is offline

Rootkit Hunter reissue of 1.4.0 release (ALLOWDEVFILE)

Posted 05-01-2012 at 11:02 AM by unSpawn

Tags rootkit hunter

Please note we've found an error with usage of exclamation points in an ALLOWDEVFILE check.
We have corrected this and have reissued 1.4.0.

NEW RELEASE SHA1: 48798beec504c00af93bf64b6e35dfc7d7aaff07
old release SHA1: 22546370647b79abce783d2a2d29352843d1b617

Apologies for the inconvenience,
unSpawn
---

unSpawn

Moderator

Posted in Uncategorized

Views 861 Comments 0 unSpawn is offline

Page 1 of 11

Last »