rootkit warnings

jayeola · 05-05-2006, 05:59 PM

Etract of warnings from rootkithunter. Checked whole system and got this message. Then ran `file` on the suspect files. are these warnings false positives?

Code:

* Filesystem checks
   Checking /dev for suspicious files...                      [ OK ]
   Scanning for hidden files...                               [ Warning! ]
---------------
 /dev/.udev.tdb  /usr/share/man/man1/..1.gz  /etc/.pwd.lock
---------------
Please inspect:  /usr/share/man/man1/..1.gz (gzip compressed data, from Unix, max compression)


* Check: SSH
   Searching for sshd_config...
   Found /etc/ssh/sshd_config
   Checking for allowed root login... Watch out Root login possible. Possible risk!
    info:
    Hint: See logfile for more information about this issue
   Checking for allowed protocols...                          [ Warning (SSH v1 allowed) ]

* Check: Events and Logging
   Search for syslog configuration...                         [ OK ]
   Checking for running syslog slave...                       [ OK ]
   Checking for logging to remote system...                   [ OK (no remote logging) ]

/dev/.udev.tdb: TDB database version 6, little-endian hash size 131 bytes
/usr/share/man/man1/..1.gz: gzip compressed data, from Unix, max compression
/etc/.pwd.lock: empty

hockeyman_102 · 05-05-2006, 06:10 PM

looks like its just warning you that ssh is allowing the login of root which if not behind a firewall could be brutforced and very malicious. I didn't see anything there to really worry about though as long as your root password is a good one, and/or your have a good firewall.

Capt_Caveman · 05-05-2006, 09:09 PM

Files outside user homedirs that have filenames prefixed with '.' (aka hidden files) are flagged by chkrootkit. Follow the advice in the output and manually inspect their contents to make sure that they do not contain anything malicious.

As per hockeyman's advice, if the machine is accessible from the internet then modify the sshd config file to disallow root logins to prevent bruteforce attempts (which are *very* common lately). Also modify the sshd config so that the daemon is using only SSH protocol 2 and not protcol 1 (or both) as protocol 1 is insecure. Change the directive reading: #Protocol 2,1 to read: Protocol 2 (note the # is removed as well to uncomment it).

jayeola · 05-05-2006, 10:18 PM

Thanks chaps. ssh is now sorted. about to read the hidden files.

unSpawn · 05-06-2006, 05:43 AM

...and if you have external means (file integrity checker like Aide, Samhain or even tripwire, or your distributions package manager) of verifying the integrity of the dot aka "hidden" files, have a look at rkunter.conf for examples on how to suppress reporting "known good" dot files.

jayeola · 05-06-2006, 01:31 PM

I'm running iptables and behind a dedicated adsl router. Would be very surprised I this box was comprimised. However it's never good to take these things for granted. Thanks for the tips chaps.