LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 03-23-2018, 06:53 AM   #1
tcz
LQ Newbie
 
Registered: Feb 2010
Posts: 3

Rep: Reputation: 0
Strange behavior -- possible rootkit?


I just attempted to install chkrootkit on debian 8.1 (running 4.9 kernel from http://kernel.ubuntu.com).

The package didn't configure and produced errors:
Code:
sudo: unable to open /var/lib/sudo/ts/#####: Read-only file system
Can't locate warnings/register.pm in @INC (you may need to install the warnings::register module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.20.2 /usr/local/share/perl/5.20.2 /usr/lib/x86_64-linux-gnu/perl5/5.20 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.20 /usr/share/perl/5.20 /usr/local/lib/site_perl .) at /usr/share/perl/5.20/vars.pm line 7.
BEGIN failed--compilation aborted at /usr/share/perl/5.20/vars.pm line 7.
Compilation failed in require at /usr/share/perl/5.20/base.pm line 4.
BEGIN failed--compilation aborted at /usr/share/perl/5.20/base.pm line 4.
Compilation failed in require at /usr/share/perl5/Debconf/Log.pm line 7.
BEGIN failed--compilation aborted at /usr/share/perl5/Debconf/Log.pm line 7.
Compilation failed in require at /usr/share/perl5/Debconf/Db.pm line 7.
BEGIN failed--compilation aborted at /usr/share/perl5/Debconf/Db.pm line 7.
Compilation failed in require at /usr/sbin/dpkg-reconfigure line 11.
BEGIN failed--compilation aborted at /usr/sbin/dpkg-reconfigure line 11.
The weird thing that has me concerned is, I did something else in the terminal window, and when I checked the scrollback all the error text had been erased.

I reproduced the error above with dpkg-reconfigure. (again scrollback was erased, and this time it was ALL of it, not just the error)

My rootfs is now in read-only mode!

So I don't know if I'm infected. I'm thinking it's just mis-configuration somewhere, or a package dependency issue.

Any thoughts?

UPDATE:
Since my system was in read only mode, I rebooted and a manual fsck was forced. There were many files with deleted inodes that fsck fixed. The other errors fixed were: "Free blocks count wrong for...", and "Free inodes count wrong for ..."

Last edited by tcz; 03-23-2018 at 08:44 AM. Reason: UPDATE:
 
Old 03-23-2018, 07:44 AM   #2
jsbjsb001
Senior Member
 
Registered: Mar 2009
Location: Earth, unfortunately...
Distribution: Currently: OpenMandriva. Previously: openSUSE, PCLinuxOS, CentOS, among others over the years.
Posts: 3,881

Rep: Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063
Quote:
Originally Posted by tcz View Post
I just attempted to install chkrootkit on debian 8.1 (running 4.9 kernel from http://kernel.ubuntu.com).

The package didn't configure and produced errors:
Code:
sudo: unable to open /var/lib/sudo/ts/#####: Read-only file system
Can't locate warnings/register.pm in @INC (you may need to install the warnings::register module) (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.20.2 /usr/local/share/perl/5.20.2 /usr/lib/x86_64-linux-gnu/perl5/5.20 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.20 /usr/share/perl/5.20 /usr/local/lib/site_perl .) at /usr/share/perl/5.20/vars.pm line 7.
BEGIN failed--compilation aborted at /usr/share/perl/5.20/vars.pm line 7.
Compilation failed in require at /usr/share/perl/5.20/base.pm line 4.
BEGIN failed--compilation aborted at /usr/share/perl/5.20/base.pm line 4.
Compilation failed in require at /usr/share/perl5/Debconf/Log.pm line 7.
BEGIN failed--compilation aborted at /usr/share/perl5/Debconf/Log.pm line 7.
Compilation failed in require at /usr/share/perl5/Debconf/Db.pm line 7.
BEGIN failed--compilation aborted at /usr/share/perl5/Debconf/Db.pm line 7.
Compilation failed in require at /usr/sbin/dpkg-reconfigure line 11.
BEGIN failed--compilation aborted at /usr/sbin/dpkg-reconfigure line 11.
The weird thing that has me concerned is, I did something else in the terminal window, and when I checked the scrollback all the error text had been erased.

I reproduced the error above with dpkg-reconfigure. (again scrollback was erased, and this time it was ALL of it, not just the error)

My rootfs is now in read-only mode!

So I don't know if I'm infected. I'm thinking it's just mis-configuration somewhere, or a package dependency issue.

Any thoughts?
I have to be honest in saying that, I'm not seeing anything from what you have said that makes me think your system is "infected" by a "rootkit".

But that aside, did you inspect lines 4, 7 or 11 ? How can we know if you don't say?

Why don't you just install rkhunter from your package manager instead? Wouldn't that be a lot easier?
 
Old 03-23-2018, 08:38 AM   #3
tcz
LQ Newbie
 
Registered: Feb 2010
Posts: 3

Original Poster
Rep: Reputation: 0
Hi jsbjsb001,
Thank you for the prompt response. I've replied to your message below.

Quote:
Originally Posted by jsbjsb001 View Post
I have to be honest in saying that, I'm not seeing anything from what you have said that makes me think your system is "infected" by a "rootkit".
It's the weird behavior that has me concerned. Isn't one of the directives of the rootkit builder to stop any software that would track it down and remove it.

Quote:
Originally Posted by jsbjsb001 View Post
But that aside, did you inspect lines 4, 7 or 11 ? How can we know if you don't say?
Sorry, but I don't think that I should be responsible to debug a package install. That would be perhaps a bug I would (should?) file with the package maintainer.

Quote:
Originally Posted by jsbjsb001 View Post
Why don't you just install rkhunter from your package manager instead? Wouldn't that be a lot easier?
I can try that thank you.
 
Old 03-23-2018, 08:45 AM   #4
jsbjsb001
Senior Member
 
Registered: Mar 2009
Location: Earth, unfortunately...
Distribution: Currently: OpenMandriva. Previously: openSUSE, PCLinuxOS, CentOS, among others over the years.
Posts: 3,881

Rep: Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063Reputation: 2063
Quote:
Originally Posted by tcz View Post
Hi jsbjsb001,
...
It's the weird behavior that has me concerned. Isn't one of the directives of the rootkit builder to stop any software that would track it down and remove it.
I think you're getting two different concepts mixed up; installing something and compiling something are two different things, not one of the same thing. Yes, you would still need to 'install' xy or z onto your system AFTER you have compiled it, if you're not installing it via software packages. Compiling something on the other hand is the act of taking something from being just a bunch of code (human-readable code that is) to machine code that the processor understands as a set of instructions to execute when run.

Yes, if for example there's a problem in the code and it cannot continue building it, it should stop at that point, until you fix the problem.

Quote:
Sorry, but I don't think that I should be responsible to debug a package install. That would be perhaps a bug I would (should?) file with the package maintainer.
That's why I suggested you install rkhunter from your package manager instead.
 
Old 03-23-2018, 11:14 AM   #5
MadeInGermany
Senior Member
 
Registered: Dec 2011
Location: Simplicity
Posts: 2,768

Rep: Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192
I think your disk did not respond for some time, and the disk driver in the kernel got impationed and set the filesystem to read-only.
It was not necessarily caused by your installation attempt - any prior writing to the disk can have triggered the fault.
Maybe your disk becomes faulty?
Is your disk accessed over a network (SAN,ISCSI,or a virtualized disk)? Then a network disturbance can have caused it.

Last edited by MadeInGermany; 03-23-2018 at 11:20 AM.
 
Old 03-23-2018, 03:51 PM   #6
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,524

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
It looks like a disk defect causing the system to remount the root file system as read only. Check the drive with smartctl. If you don't have it installed, it's part of smartmon-tools.
 
Old 03-23-2018, 07:45 PM   #7
tcz
LQ Newbie
 
Registered: Feb 2010
Posts: 3

Original Poster
Rep: Reputation: 0
Turns out it was installing ANY package that generated the error.
I ran
Code:
sudo apt-key update
...output...
gpg: Total number processed: 8
gpg:              unchanged: 8

sudo apt-get update
And everything seems to be working without error now.
 
Old 03-23-2018, 07:50 PM   #8
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,524

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
It might work for a while, but there's a reason /var was on a read-only file system.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Strange behavior battles Linux - Newbie 5 07-10-2014 08:59 AM
Strange su Problem (Rootkit possibly) LinuxGeek Linux - Software 2 06-13-2005 04:02 PM
Very Strange Behavior raysr Mandriva 4 08-31-2004 02:06 PM
Strange Behavior andrewb758 Linux - Hardware 5 08-31-2003 02:42 PM
strange behavior abhijit Linux - General 3 07-09-2003 11:25 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 12:54 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration