Problems with rkhunter 1.4.6

ChuangTzu · 05-28-2018, 06:45 PM

Just an FYI, in case anyone runs rkhunter 1.4.6.

I noticed what is most likely a bug that is reproducible on various distros (yes I will submit the info to the dev., if possible).

When running rkhunter -c (event after --propupd) it will report finding between 2-8 rootkits, depending on the distro (Slackware 14.2, Salix 14.2, Debian 9 and Ubuntu 18.04-and derivatives). Note: Debian version is 1.4.2-6+deb9u1, but produces same results. *Clarify: 1.4.2-6 on Debian 9 does not produce these results, however, 1.4.6-2 from Debian 10 Buster/testing does.*

After downgrading to version 1.4.0, it reports 0 rootkits on the same distros and same machines. Results are same whether run from liveCD, VM or bare metal. There must be a setting or something with v. 1.4.6 that is throwing up more false positives then usual.

Anyone else notice this?

Added: Bug report submitted.

luizlmarins · 05-29-2018, 09:53 AM

Also ... rkhunter shows the Evince pdf reader as rootkit.

jsbjsb001 · 05-29-2018, 10:24 AM

Quote:

Originally Posted by ChuangTzu

Just an FYI, in case anyone runs rkhunter 1.4.6.

I noticed what is most likely a bug that is reproducible on various distros (yes I will submit the info to the dev., if possible).

When running rkhunter -c (event after --propupd) it will report finding between 2-8 rootkits, depending on the distro (Slackware 14.2, Salix 14.2, Debian 9 and Ubuntu 18.04-and derivatives). Note: Debian version is 1.4.2-6+deb9u1, but produces same results.

After downgrading to version 1.4.0, it reports 0 rootkits on the same distros and same machines. Results are same whether run from liveCD, VM or bare metal. There must be a setting or something with v. 1.4.6 that is throwing up more false positives then usual.

Anyone else notice this?

Added: Bug report submitted.

Well, -1 for CentOS 7.4, as nope, not on my system it doesn't;

Code:

[root@jamespc ~]# rkhunter --propupd
[ Rootkit Hunter version 1.4.6 ]
File updated: searched for 176 files, found 136

Code:

[output snipped]
System checks summary
=====================

File properties checks...
    Files checked: 136
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 503
    Possible rootkits: 0

CentOS 7.4 wins!

AwesomeMachine · 05-29-2018, 12:09 PM

Rkhunter is an advisory program. It's up to the user to check whether its correct. And, in MHO, rkhunter is just a step above hucksterism.