chkrootkit message

PennyroyalFrog · 11-27-2005, 01:22 AM

chkrootkit outputs the following line:

Code:

Checking `sniffer'... /proc/28059/fd: No such file or directory

Is this something to be worried about? Thanks in advance.

lacerto · 11-27-2005, 07:18 AM

Nothing to worry about - the number directories are running process information by PID. Just means you don't have that particular process running

PennyroyalFrog · 11-27-2005, 10:42 AM

Thanks

PennyroyalFrog · 11-27-2005, 11:04 AM

Also, I get:

Code:

Checking `sniffer'... eth0: PF_PACKET(/sbin/dhcpcd)

I have pretty much have always had this and assumed it was a false positive. I get it everytime I run chkrootkit, and was curious if that was odd since i thought that the dhcp client doesn't always look for or check the dhcp server, or does it? Somebody enlighten me if this is also a false postive plz. Thanks

PennyroyalFrog · 11-27-2005, 06:38 PM

don't want to bump, but i'm kinda anxious about this

Capt_Caveman · 11-27-2005, 07:30 PM

It's also a common false positive that has to do with the type of socket that the DHCP client uses. You should still always verify the integrity of the dhcpd binary. On rpm-based systems you can use rpm -V binary name or compare its md5 hash to a known good version. Also I believe the other message has to do with short lived processes terminating before the check can be made. When you get a warning like that, you should re-run the scan and make sure that it comes back clean (i.e that the flagged file descriptor doesn't show up again).

PennyroyalFrog · 11-27-2005, 11:32 PM

Yea, ran chkrootkit again and it still appeared after several times (the /proc/#####/fd that is) but after i rebooted i no longer get it. I've googled it (before posting) and saw it some outputs of what people posted however nobody referred to that part as being a "true positive". I asked here cuz I can get a more targeted answer.

So you think both were false positives? I run gentoo btw, so no rpms, but i'll see if i can compare the md5 of the tarball portage used with a known one. Thanks.