rkhunter warning

qwertyjjj · 02-12-2010, 06:26 PM

I got this in my rkhunter, is it anything to be worried about?

* Filesystem checks
Checking /dev for suspicious files... [ OK ]
Scanning for hidden files... [ Warning! ]
---------------
/etc/.pwd.lock /usr/sbin/.sshd.hmac /usr/bin/.fipscheck.hmac
/usr/bin/.ssh.hmac /usr/share/man/man1/..1.gz /dev/.udev
---------------
Please inspect: /usr/sbin/.sshd.hmac (ASCII text) /usr/bin/.fipscheck.hmac (ASCII text) /usr/bin/.ssh.hmac (ASCII text) /usr/share/man/man1/..1.gz (gzip compressed data, from Unix, max compression) /dev/.udev (directory)

adam999 · 02-12-2010, 06:35 PM

What's inside these files? Is sshd exposed to the Internet?

qwertyjjj · 02-12-2010, 06:40 PM

Quote:

Originally Posted by adam999

What's inside these files? Is sshd exposed to the Internet?

I'm not sure, I've never seen these files.
sshd is exposed to the net but on a different port and also not for root login so pretty unlikely that anyone could login.

sshd.hmac

Quote:

48209ecaac55e102e5b8f91d38d620c8b9697c4dc4826f9b9529d938f19e88e9

fipschecl

Quote:

78c2a83b38abd0dacc35e1e17072156b070ee70aacabd1110cdf698927a8f39f

adam999 · 02-12-2010, 06:45 PM

If u run

Code:

cat /usr/bin/.ssh.hmac

what output do u get?

qwertyjjj · 02-12-2010, 08:19 PM

Quote:

Originally Posted by adam999

If u run

Code:

cat /usr/bin/.ssh.hmac

what output do u get?

[root@server ~]# cat /usr/bin/.ssh.hmac
d4a1e5bf3384c668f500b14f9ad9326ffe0fbebd2c77d5606607b52886b007c4

adam999 · 02-13-2010, 09:00 AM

just checked, i have that same file,

Code:

[root@localhost ~]# rpm -qf /usr/sbin/.sshd.hmac
openssh-server-5.2p1-2.fc11.i586

Code:

[root@localhost ~]# rpm -qf /usr/bin/.fipscheck.hmac
fipscheck-1.2.0-1a.fc11.i586

Nothing to worry about