Re: rkhunter su sid...
Il giorno ven, 22/04/2011 alle 18.56 +0200, SubSoNiK ha scritto:
> non so darti una risposta...ma sarei curioso di vedere i log per
> confrontarli magari con i miei e studiare meglio il funzionamento di
> rkhunter visto che non ho mai ben capito la ragione di un sacco di warning!
>
Gia' questo mi rassicura un po' :-)
> hei quale policy con tutto lo spam che gira in lista!!!!!!! ;P
>
In lista puo' girare tutto lo spam che vuole, ma se c'e' una policy che
vieta gli attachment...
Vabbe' la aggiro in puro stile maggioranza al governo :-)
[15:55:58] /bin/ip [ Warning ]
[15:55:58] Warning: The file properties have changed:
[15:55:58] File: /bin/ip
[15:55:58] Current hash: fe1f1e5574d94b1eb5edac342bc9367aa50c3497
[15:55:58] Stored hash : c912b6625da588be1c18632a3bc1a5aae8f4ebd4
[15:55:58] Current inode: 8689 Stored inode: 8222
[15:55:58] Current size: 225832 Stored size: 225148
[15:55:58] Current file modification time: 1302176974 (07-apr-2011 13:49:34)
[15:55:58] Stored file modification time : 1297101611 (07-feb-2011 19:00:11)
[15:55:59] /bin/less [ Warning ]
[15:55:59] Warning: The file properties have changed:
[15:55:59] File: /bin/less
[15:55:59] Current hash: a762f8f60f6c80fc1f82fde22c73d625593c2e87
[15:55:59] Stored hash : f626ae54b83f533a54de59174093646a70dc18cf
[15:55:59] Current inode: 9485 Stored inode: 9241
[15:55:59] Current size: 123424 Stored size: 122144
[15:55:59] Current file modification time: 1302669401 (13-apr-2011 06:36:41)
[15:55:59] Stored file modification time : 1248853903 (29-lug-2009 09:51:43)
[15:56:02] /usr/bin/curl [ Warning ]
[15:56:02] Warning: The file properties have changed:
[15:56:02] File: /usr/bin/curl
[15:56:02] Current hash: 3c02753ab3445e48220484003cb794a56c58abce
[15:56:02] Stored hash : aedbf07622e84c948ac189f9fb134bf2b1ece5ff
[15:56:02] Current inode: 7051 Stored inode: 455980
[15:56:02] Current size: 116860 Stored size: 116988
[15:56:02] Current file modification time: 1302765546 (14-apr-2011 09:19:06)
[15:56:02] Stored file modification time : 1295457422 (19-gen-2011 18:17:02)
[15:56:03] /usr/bin/dpkg [ Warning ]
[15:56:03] Warning: The file properties have changed:
[15:56:03] File: /usr/bin/dpkg
[15:56:03] Current hash: 4a700940270d2d6d1e43f35368e1f1d60a72ba82
[15:56:03] Stored hash : cee5166506d74e0b6667585b54d5eb56771ac7b9
[15:56:03] Current inode: 5187 Stored inode: 7408
[15:56:03] Current size: 202608 Stored size: 206996
[15:56:03] Current file modification time: 1302924799 (16-apr-2011 05:33:19)
[15:56:03] Stored file modification time : 1296421025 (30-gen-2011 21:57:05)
[15:56:03] /usr/bin/dpkg-query [ Warning ]
[15:56:03] Warning: The file properties have changed:
[15:56:03] File: /usr/bin/dpkg-query
[15:56:03] Current hash: 4b678889a38aec249cde1659047c2b68a6f681ef
[15:56:03] Stored hash : 429a0d744e64fd17a07d33312f1927b37e81e230
[15:56:03] Current inode: 5700 Stored inode: 7410
[15:56:03] Current size: 88944 Stored size: 93992
[15:56:03] Current file modification time: 1302924799 (16-apr-2011 05:33:19)
[15:56:03] Stored file modification time : 1296421025 (30-gen-2011 21:57:05)
[15:56:04] /usr/bin/file [ Warning ]
[15:56:04] Warning: The file properties have changed:
[15:56:04] File: /usr/bin/file
[15:56:04] Current hash: d8fb1208e198de78c07e1a6f4cd5c0a91f0a81cf
[15:56:04] Stored hash : d05b77faae50117e8eb80d8231d315fed5e67a27
[15:56:04] Current inode: 5526 Stored inode: 5477
[15:56:04] Current size: 12208 Stored size: 12304
[15:56:04] Current file modification time: 1302911400 (16-apr-2011 01:50:00)
[15:56:04] Stored file modification time : 1281021290 (05-ago-2010 17:14:50)
[15:56:05] /usr/bin/last [ Warning ]
[15:56:05] Warning: The file properties have changed:
[15:56:05] File: /usr/bin/last
[15:56:05] Current hash: 89a0fde467b7758582347b60b31d39c47fab338d
[15:56:05] Stored hash : a18bfd4218dcdf59b81663fb935a2219df7fb8ba
[15:56:05] Current inode: 6850 Stored inode: 455591
[15:56:05] Current size: 12704 Stored size: 12508
[15:56:05] Current file modification time: 1302033059 (05-apr-2011 21:50:59)
[15:56:05] Stored file modification time : 1293860108 (01-gen-2011 06:35:08)
[15:56:05] /usr/bin/less [ Warning ]
[15:56:05] Warning: The file properties have changed:
[15:56:05] File: /usr/bin/less
[15:56:05] Current hash: a762f8f60f6c80fc1f82fde22c73d625593c2e87
[15:56:05] Stored hash : f626ae54b83f533a54de59174093646a70dc18cf
[15:56:05] Current inode: 455306 Stored inode: 6295
[15:56:06] Current file modification time: 1302669401 (13-apr-2011 06:36:41)
[15:56:06] Stored file modification time : 1271888642 (22-apr-2010 00:24:02)
[15:56:06] /usr/bin/links [ Warning ]
[15:56:06] Warning: The file properties have changed:
[15:56:06] File: /usr/bin/links
[15:56:06] Current hash: 56a2bc5d4fcfa84c2e3b61f37aa4d75b96dba142
[15:56:06] Stored hash : d7693ddcca836cd0d6104e79f18f5affb21062f9
[15:56:06] Current inode: 454867 Stored inode: 455561
[15:56:06] Current size: 1132244 Stored size: 1052404
[15:56:06] Current file modification time: 1302642820 (12-apr-2011 23:13:40)
[15:56:06] Stored file modification time : 1278688592 (09-lug-2010 17:16:32)
[15:56:07] /usr/bin/perl [ Warning ]
[15:56:07] Warning: The file properties have changed:
[15:56:07] File: /usr/bin/perl
[15:56:07] Current hash: ede4ca6310123f3ee7f83421fe52b6e2e61f1689
[15:56:07] Stored hash : 179359677d788919e706ab45297c4207a1b9ddfd
[15:56:07] Current inode: 5284 Stored inode: 4162
[15:56:07] Current size: 1241084 Stored size: 1241308
[15:56:07] Current file modification time: 1301648020 (01-apr-2011 10:53:40)
[15:56:07] Stored file modification time : 1294407695 (07-gen-2011 14:41:35)
[15:56:09] /usr/bin/size [ Warning ]
[15:56:09] Warning: The file properties have changed:
[15:56:09] File: /usr/bin/size
[15:56:09] Current hash: b7c16bcbf9bda0279ec5a714a433f5468651e612
[15:56:09] Stored hash : f874e30a392f14e51dc9db3ba538e9c6ea4c0405
[15:56:09] Current inode: 457151 Stored inode: 204321
[15:56:09] Current file modification time: 1303220636 (19-apr-2011 15:43:56)
[15:56:09] Stored file modification time : 1295920383 (25-gen-2011 02:53:03)
[15:56:09] /usr/bin/strace [ Warning ]
[15:56:09] Warning: The file properties have changed:
[15:56:09] File: /usr/bin/strace
[15:56:09] Current hash: 248688f72d0bb49e872c65be7cc46b356cb9b496
[15:56:09] Stored hash : bdba7e188bc0496e406a444bebfff15fa931a231
[15:56:09] Current inode: 6162 Stored inode: 457493
[15:56:09] Current file modification time: 1301619195 (01-apr-2011 02:53:15)
[15:56:09] Stored file modification time : 1272980066 (04-mag-2010 15:34:26)
[15:56:09] /usr/bin/strings [ Warning ]
[15:56:09] Warning: The file properties have changed:
[15:56:09] File: /usr/bin/strings
[15:56:09] Current hash: a95a52bd5db8b8c2a1389a6b30e7ccc823610bbb
[15:56:09] Stored hash : c372293c3cea344806d25353b4ffabf2a405c0ca
[15:56:09] Current inode: 457112 Stored inode: 204285
[15:56:09] Current size: 20928 Stored size: 20512
[15:56:10] Current file modification time: 1303220636 (19-apr-2011 15:43:56)
[15:56:10] Stored file modification time : 1295920383 (25-gen-2011 02:53:03)
[15:56:11] /usr/bin/wget [ Warning ]
[15:56:11] Warning: The file properties have changed:
[15:56:11] File: /usr/bin/wget
[15:56:11] Current hash: ab38db8272fd7e01be11591db4d8c319cf2a0e5a
[15:56:11] Stored hash : 938b9f038907fd1163e062e62c5982c5559c5e0e
[15:56:11] Current inode: 456584 Stored inode: 4299
[15:56:11] Current size: 327024 Stored size: 329488
[15:56:11] Current file modification time: 1301650763 (01-apr-2011 11:39:23)
[15:56:11] Stored file modification time : 1283694231 (05-set-2010 15:43:51)
[15:56:11] /usr/bin/whatis [ Warning ]
[15:56:11] Warning: The file properties have changed:
[15:56:11] File: /usr/bin/whatis
[15:56:11] Current hash: ee771dfb687c793ca9c5fd1f68d1e1adaf347cb4
[15:56:11] Stored hash : 62b1cff971576b38c9e9d2f39facd311ab4a6b44
[15:56:11] Current inode: 455307 Stored inode: 456401
[15:56:11] Current size: 34516 Stored size: 34492
[15:56:12] Current file modification time: 1302694435 (13-apr-2011 13:33:55)
[15:56:12] Stored file modification time : 1297162126 (08-feb-2011 11:48:46)
[15:56:14] /sbin/init [ Warning ]
[15:56:14] Warning: The file properties have changed:
[15:56:14] File: /sbin/init
[15:56:14] Current hash: 4bfd9b7ad982b12d4bfc197f2d787f84949c9ad2
[15:56:14] Stored hash : 411b39939fcf4e6ed502e649aaa5d3941fb614de
[15:56:14] Current inode: 8068 Stored inode: 4122
[15:56:14] Current size: 31452 Stored size: 31676
[15:56:14] Current file modification time: 1302033059 (05-apr-2011 21:50:59)
[15:56:14] Stored file modification time : 1293860108 (01-gen-2011 06:35:08)
[15:56:14] /sbin/ip [ Warning ]
[15:56:14] Warning: The file properties have changed:
[15:56:14] File: /sbin/ip
[15:56:14] Current hash: fe1f1e5574d94b1eb5edac342bc9367aa50c3497
[15:56:14] Stored hash : c912b6625da588be1c18632a3bc1a5aae8f4ebd4
[15:56:14] Current inode: 457996 Stored inode: 457774
[15:56:14] Current file modification time: 1302176973 (07-apr-2011 13:49:33)
[15:56:14] Stored file modification time : 1298067201 (18-feb-2011 23:13:21)
[15:56:15] /sbin/runlevel [ Warning ]
[15:56:15] Warning: The file properties have changed:
[15:56:15] File: /sbin/runlevel
[15:56:15] Current hash: 7b9357d32cadefca29cd76ea6b9d867efbd0ecc6
[15:56:15] Stored hash : e42bb3473aa5dc2a87c0c29245b75f5fdac6aff2
[15:56:15] Current inode: 6434 Stored inode: 5063
[15:56:15] Current size: 3268 Stored size: 3284
[15:56:15] Current file modification time: 1302033059 (05-apr-2011 21:50:59)
[15:56:15] Stored file modification time : 1293860108 (01-gen-2011 06:35:08)
[15:56:16] /sbin/sulogin [ Warning ]
[15:56:16] Warning: The file properties have changed:
[15:56:16] File: /sbin/sulogin
[15:56:16] Current hash: a6c0bfbca1a73db459fbe348d842ec180acbe486
[15:56:16] Stored hash : bd2d54a9fc4a36c0da2d0d7e4dffb44b5c4954ff
[15:56:16] Current inode: 200716 Stored inode: 4858
[15:56:16] Current file modification time: 1302033059 (05-apr-2011 21:50:59)
[15:56:16] Stored file modification time : 1293860108 (01-gen-2011 06:35:08)
[15:56:18] /usr/sbin/rsyslogd [ Warning ]
[15:56:18] Warning: The file properties have changed:
[15:56:18] File: /usr/sbin/rsyslogd
[15:56:18] Current hash: f4535e90f4ac6f876c60f4dc0cab95bacb1d14d8
[15:56:18] Stored hash : 749e68fdf4000b1ab6f917506ff46a317b32d050
[15:56:18] Current inode: 7613 Stored inode: 5963
[15:56:18] Current size: 337564 Stored size: 333500
[15:56:18] Current file modification time: 1302612168 (12-apr-2011 14:42:48)
[15:56:18] Stored file modification time : 1298286817 (21-feb-2011 12:13:37)
[15:56:19] /usr/sbin/tcpd [ Warning ]
[15:56:19] Warning: The file '/usr/sbin/tcpd' exists on the system, but it is not present in the rkhunter.dat file.
[15:57:25] Warning: Checking for possible rootkit strings [ Warning ]
[15:57:25] Found string 'hdparm' in file '/etc/init.d/.depend.boot'. Possible rootkit: Xzibit Rootkit
[15:57:25] Found string 'hdparm' in file '/etc/init.d/hdparm'. Possible rootkit: Xzibit Rootkit
[15:57:25]
[15:58:29] Info: SCAN_MODE_DEV set to 'THOROUGH'
[15:58:29] Checking /dev for suspicious file types [ None found ]
[15:58:29] Checking for hidden files and directories [ Warning ]
[15:58:29] Warning: Hidden directory found: /etc/.java
[15:58:29] Warning: Hidden directory found: /dev/.udev
[15:58:29] Warning: Hidden directory found: /dev/.initramfs
[15:58:34]
[15:58:34]
[15:58:34] System checks summary
[15:58:34] =====================
[15:58:34]
[15:58:34] File properties checks...
[15:58:34] Files checked: 136
[15:58:34] Suspect files: 21
[15:58:34]
[15:58:34] Rootkit checks...
[15:58:34] Rootkits checked : 245
[15:58:34] Possible rootkits: 2
[15:58:34] Rootkit names : Xzibit Rootkit, Xzibit Rootkit
[15:58:34]
[15:58:34] Applications checks...
[15:58:34] All checks skipped
[15:58:34]
[15:58:34] The system checks took: 2 minutes and 43 seconds
[15:58:34]
[15:58:34] Info: End date is ven 22 apr 2011, 15.58.34, CEST
Paride
--
http://keyserver.linux.it/pks/lookup?op=get&search=0xCC6CA35C690431D3
Chi è pronto a rinunciare alle proprie libertà fondamentali per
comprarsi briciole di temporanea sicurezza non merita né la libertà né
la sicurezza.”
(Benjamin Franklin, 11 novembre 1755)
Reply to: