Hi,

I ran chkrootkit today and got an unusual output - I am concerned but not familiar enough with this to know if I have a problem. If someone could please help me understand this output I would be grateful:

Checking `chkutmp'... The tty of the following user process(es) were not found
in /var/run/utmp !
! RUID PID TTY CMD
! root 15188 tty7 /usr/X11R6/bin/X -br -nolisten tcp :0 vt7
chkutmp: nothing deleted

Thanks so very much
Tommy

I ran chkrootkit today
Which version?


Checking `chkutmp'... The tty of the following user process(es) were not found in /var/run/utmp
The process is attached to a tty but no audit record was found in /var/run/utmp. Normal behaviour for processes that wait for a login to occur. If you want to run some checks run "w" (shows there's nobody at that tty), compare output of "readlink -f /proc/15188" with "readlink -f /usr/X11R6/bin/X" (process uses same binary) and "rpm -Vv --noscripts XFree86" (should not show MD5 problems).

Hi -- Thanks responding

I'm using version 0.45

w --> shows only me.
When I run readlink -f /usr/X11R6/bin/X and readlink -f /proc/15188 I do get to different results, plus if I kill process 15188 it returns as another process which as also complained about by chkrootkit.

readlink -f /proc/15188 returns: /proc/15188
readlink -f /usr/X11R6/bin/X returns: /usr/X11R6/bin/Xorg

rpm -Vv --noscripts XFree86
rpm: script disabling options may only be specified during package installation and erasure

One more follow up -

I ran rkhunter 1.2.8 and it hangs while "testing running processes"

When I run readlink -f /usr/X11R6/bin/X and readlink -f /proc/15188 I do get to different results
Sorry. Should be "readlink -f /proc/15188/exe", else you don't have the link to the binary.


plus if I kill process 15188 it returns as another process which as also complained about by chkrootkit.
Nobody asked you to kill stuff. This is kind of theoretical since the chance chkutmp's tty warnings alone pointing to a compromise can be considered almost nonexistant, but killing stuff is a good way to loose data in case something suspicious happened and a good way to attract attention.


rpm -Vv --noscripts XFree86
rpm: script disabling options may only be specified during package installation and erasure
Well, if the "--noscripts" switch doesn't make rpm run, then run it without the switch.


I ran rkhunter 1.2.8
RKH is at 1.2.9 older versions are *not* supported.