i upgraded my debian etch box last night, it upgraded a lot of things including mysql, and today my tiger logs and chkrootkit cron jobs say i've been hacked with the "Showtee" rootkit. i'm not sure how that's possible, because /etc/hosts.deny denies ALL to sshd, and hosts.allow only contains the IPs on the LAN that are allowed to use ssh and nfs. i use protocol 2 and key based authentication, i.e., no passwords, just the key. the box runs apache, proftpd, and mysql - could any ports associated with those apps be sources of the hack? nothing looks out of the ordinary in any logs (except the usual hack attempts of proftpd from china, germany, etc. using the non-existent "Administrator" account ). rkhunter says everything is "green"/OK.

i've shut off all internet access to the box at the firewall and scanned the other computers on the network, which come up clean. my gut feeling is that this "showtee" is a false positive, some library or something changed by the upgrade, but i can't find much about it on google. what should i do next?


p.s. h4ck3rs suc|<

Not Debian specific but take a look at:
chkrootkit found ifconfig infected - LinuxQuestions.org
http://www.linuxquestions.org/questi...d.php?t=295765

thanks, i've gone through that thread and the excellent link there to the "redhat" hack page (along with about a dozen other pages on LQ that have showtee in them), but i'm not coming up with anything.

i guess i have 2 options: make md5sums and check them against known good versions? how will i know that a debian package hasn't upgraded by the time i get to compare my version against it? i'm not even sure which ones to check. or 2, clean drive and reinstall the OS.

btw, since this probably isn't debian specific after all, could a mod move it to security? appreciate.


p.s. h4ck3rs *REALLY* suc|<


---------------------
>>Solved. it was a file in the flex package.

they don't suck ... script kiddies suck..

Back-up your filesystem, dd (dd if=/dev/zero of=/dev/hdX) the disk and re-install.

Re-create the system as much as possible and see if chkrootkit whines.

-Reth

see edit above. it was libfl.so from the flex package. i just removed flex and that took care of it. i don't know why that was installed anyway, it doesn't seem to be a dependency of anything else i'm using, and i'm not doing any programming, if that's what it's used for. i guess it's possible i got hacked and someone installed flex, but it seems unlikely.


>>edit - link:
http://lists.debian.org/debian-user/.../msg01095.html