using chkrootkit on my server

linuxhippy · 09-13-2007, 06:54 PM

I just used chkrootkit-0.47 on my Slackware 12 server running kernel-2.6.22.6 and iptables 1.38. I just installed it last weekend and am fairly certain it's not been cracked into yet. It serves mp3s with gnump3d which uses user nobody along with tor. The only flagged output message with chkrootkit was this:

Checking `crontab'... Warning: crontab for nobody found, possible Lupper.Worm

Should I be concerned about this? I changed nobody's password with root so that I could login. I cannot login to user nobody....as soon as I login it bounces me out.

gilead · 09-13-2007, 07:42 PM

I got the same thing - on an isolated system that I was pretty sure hadn't been compromised during the upgrade. I haven't made the time to check why the following line returns true:

Code:

if  ${CMD} -l -u nobody >/dev/null 2>&1

I'm not worried since according to http://vil.nai.com/vil/content/v_136821.htm, Lupper affects web servers running vulnerable scripts and my web server runs as apache, not nobody. Until I do I've added the following to the chkrootkit cron job on the box and they always confirm that the users do not have a crontab and it's a false positive:

Code:

/usr/bin/crontab -l -u apache 2>&1
/usr/bin/crontab -l -u nobody 2>&1

The code from chkrootkit looks like it's supposed to add the value of the STATUS variable (infected or not) to that message. It could be as simple as the not infected state is not being written to the variable.

linuxhippy · 09-13-2007, 07:57 PM

nice! I get this about crontab for nobody:

no crontab for nobody

Guess it was a false positive!