rkhunter Security scanning generated the following warnings

max_tcs · 06-24-2007, 11:14 PM

I received this message from rkhunter this morning

This letter was generated by security scanner started on host xxxxx.com at Jun 24, 2007 01:01 AM.
Please inspect this machine because there can be security problems or holes
in its protection, or the machine can be infected.

Note: It is recommended that you re-run security scanning on the machine via Plesk control panel before you make any changes to the machine configuration.
Security scanning generated the following warnings (the full scanning log is available at /var/log/rkhunter.log):

[01:00:13] Warning: This operating system is not fully supported!
[01:01:04] WARNING, found: /etc/.java (directory)

and this is the logs from /etc/log/rkhunter.log

[01:01:11] ------------------------- Security advisories -------------------------
[01:01:11] Info: Found 'PermitRootLogin no' or 'PermitRootLogin without-password'
[01:01:12] Scanned for: 55808 Trojan - Variant A, AjaKit, aPa Kit, Apache Worm, Ambient (ark) Rootkit, Balaur Rootkit, BeastKit, beX2, BOBKit, CiNIK Worm (Slapper.B variant), Danny-Boy's Abuse Kit, Devil RootKit, Dica, Dreams Rootkit, Duarawkz, Flea Linux Rootkit, FreeBSD Rootkit, Fuck`it Rootkit, GasKit, Heroin LKM, HjC Kit, ignoKit, ImperalsS-FBRK, Irix Rootkit, Kitko, Knark, Li0n Worm, Lockit / LJK2, MRK, Ni0 Rootkit, RootKit for SunOS / NSDAP, Optic Kit (Tux), Oz Rootkit, Portacelo, R3dstorm Toolkit, RH-Sharpe's rootkit, RSHA's rootkit, Scalper Worm, Shutdown, SHV4, SHV5, Sin Rootkit, Slapper, Sneakin Rootkit, Suckit Rootkit, SunOS Rootkit, Superkit, TBD (Telnet BackDoor), TeLeKiT, T0rn Rootkit, Trojanit Kit, Tuxtendo, URK, VcKit, Volc Rootkit, X-Org SunOS Rootkit, zaRwT.KiT Rootkit
[01:01:12] 3 vulnerable applications found

I just checked /etc/.java/.systemPrefs and it had two empty files:

[root@xxxx .systemPrefs]# pwd
/etc/.java/.systemPrefs
[root@xxxx .systemPrefs]# ll -a
total 8
drwxr-xr-x 2 root root 4096 May 6 2006 .
drwxr-xr-x 3 root root 4096 May 6 2006 ..
-rw-r--r-- 1 root root 0 May 6 2006 .system.lock
-rw-r--r-- 1 root root 0 May 6 2006 .systemRootModFile

what should i do to resolve this problem ?

unSpawn · 06-25-2007, 01:09 AM

If you check the RKH FAQ, mailing list archives and your rkhunter.conf you'll read how to validate and exclude these entries from scanning.