RKhunter warning about hidden files.

gonus · 05-02-2007, 07:09 PM

* Filesystem checks
Checking /dev for suspicious files... -e [ OK ]
Scanning for hidden files...-e [ Warning! ]
---------------
/dev/.static
/dev/.udev
/dev/.initramfs
/dev/.initramfs-tools /etc/.pwd.lock
/etc/.java
---------------
Please inspect: /dev/.static (directory) /dev/.udev (directory) /dev/.initramfs (directory) /etc/.java (directory)

[Press <ENTER> to continue]

Uber noob to linux security. What should I be looking for? I appreciate any responses.

G

Okie · 05-02-2007, 07:26 PM

nothing to worry about, it wont hurt to read the contents of those files just in case, but i doubt there is anything wrong with having those files, (they are probably supposed to be there so don't delete them)...

gilead · 05-02-2007, 07:59 PM

As Okie says, inspect the directories to see whether there is anything suspicious in there. If you're not sure, then ask here with some info about what you found. Once you're satisfied there's no problem with those directories you can add them to the rkhunter.conf file (/usr/local/etc/rkhunter.conf on my system). Here are the ALLOWHIDDENDIR entries on my system:

Code:

ALLOWHIDDENDIR=/etc/.java
ALLOWHIDDENDIR=/etc/.pwd.lock
ALLOWHIDDENDIR=/dev/.udev.tdb
ALLOWHIDDENDIR=/dev/.udev

gonus · 05-03-2007, 10:27 AM

Thanx guys I was getting nervous.

G