Chk Root Kit reported infection

DotHQ · 01-03-2008, 09:27 AM

I've just run chkrootkit on a few servers. One server shows an infection, but I don't know what to look for or what action to take about it.

Here is the output: `bindshell'... INFECTED (PORTS: 465)

Any clues for me?
TIA

jschiwal · 01-03-2008, 09:40 AM

Investigate what is on that port and whether it is a false positive:

Code:

Important Note: If you see 'Checking `bindshell'... INFECTED (PORTS:  465)' read on.
I'm running PortSentry/klaxon. What's wrong with the bindshell test?
If you're running PortSentry/klaxon or another program that binds itself to unused ports probably chkrootkit will give you a false positive on the bindshell test (ports 114/tcp, 465/tcp, 511/tcp, 1008/tcp, 1524/tcp, 1999/tcp, 3879/tcp, 4369/tcp, 5665/tcp, 10008/tcp, 12321/tcp, 23132/tcp, 27374/tcp, 29364/tcp, 31336/tcp, 31337/tcp, 45454/tcp, 47017/tcp, 47889/tcp, 60001/tcp).

http://www.webhostgear.com/25.html

Some programs will trigger a false alarm because they employ a technique that a cracker might. You need to determine whether this is the case or if you do indeed have a problem. Is this server running PortSentry/klaxon or something similar.

DotHQ · 01-03-2008, 09:52 AM

Yep, we are running port sentry. Thanks. Had me worried there for a minute.

unSpawn · 01-03-2008, 05:26 PM

Quote:

Originally Posted by DotHQ

Yep, we are running port sentry.

While on the subject allow me to (with all due respect) reverse plug this piece of code:
http://www.linuxquestions.org/questi...7/#post2094032
http://www.linuxquestions.org/questi...2/#post2413068
http://www.linuxquestions.org/questi...0/#post2432706

I hope you get the idea.

jschiwal · 01-03-2008, 11:36 PM

Did Cisco aquire them simply to eliminate the competition or to raid their technology? That is a worry of mine. Open Source companies being aquired for the purpose of shutting down an open source project by removing it's sponsorship or support.

---

It looks like it may be a one man operation now
http://sourceforge.net/forum/forum.php?forum_id=275043
Unless this is a different project.

unSpawn · 01-04-2008, 03:55 AM

Quote:

Originally Posted by jschiwal

It looks like it may be a one man operation now (..) Unless this is a different project.

Yes, that *is* the project. But look at the CVS tracker stats and you'll find it's a no man operation: no commits being done for ages.