Re: [HS] Panne informatique mondiale
On Tuesday 06 August 2024 13:22:51 Jean Bernon wrote:
> Je viens de passer rkhunter. J'ai plus de warnings que toi
> (sur une dizaine de fichiers). Rien de grave apparemment,
> j'essaierai d'approfondir à l'occasion.
Si on ne prend que les "warning" c'est quasi même nombre
et mêmes applis.
> cat /var/log/rkhunter.log | grep -C2 Warning
> [13:04:44] /usr/bin/awk [ OK ]
> [13:04:44] /usr/bin/basename [ OK ]
> [13:04:45] /usr/bin/bash [ Warning ]
> [13:04:45] Warning: The file properties have changed:
> [13:04:45] File: /usr/bin/bash
> [13:04:45] Current hash:
a4b895f98db75079f2af6e510c95db0d5c5d596e448bf3fe689d0bfdd182e28e
> --
> [13:04:45] /usr/bin/chown [ OK ]
> [13:04:46] /usr/bin/cp [ OK ]
> [13:04:46] /usr/bin/curl [ Warning ]
> [13:04:46] Warning: The file properties have changed:
> [13:04:46] File: /usr/bin/curl
> [13:04:46] Current hash:
da9f50c6f6a90ef1991917a3d7c3217f475af5e527ec6996cce2e464ee4d6099
> --
> [13:04:50] /usr/bin/last [ OK ]
> [13:04:50] /usr/bin/lastlog [ OK ]
> [13:04:50] /usr/bin/ldd [ Warning ]
> [13:04:50] Warning: The file properties have changed:
> [13:04:50] File: /usr/bin/ldd
> [13:04:50] Current hash:
5a6d7197748a8e1cba94c65359df147add3f66d2f87e210772cfa926bc6bccb6
> --
> [13:04:50] Stored file modification time : 1713544444
(19-avril-2024 18:34:04)
> [13:04:51] Info: Found file '/usr/bin/ldd': it is whitelisted for
the 'script replacement' check.
> [13:04:51] /usr/bin/less [ Warning ]
> [13:04:51] Warning: The file properties have changed:
> [13:04:51] File: /usr/bin/less
> [13:04:51] Current hash:
411d7dabb7fb71fc65a0ad4bc0349d543c36b4df8d2f875e192dbee934b2b13f
> --
> [13:04:56] /usr/bin/size [ OK ]
> [13:04:56] /usr/bin/sort [ OK ]
> [13:04:57] /usr/bin/ssh [ Warning ]
> [13:04:57] Warning: The file properties have changed:
> [13:04:57] File: /usr/bin/ssh
> [13:04:57] Current hash:
5fd74cf5f131896d17f49ae0f6ac2a6d2ea433620650418ee879afa262259078
> --
> [13:05:00] /usr/bin/numfmt [ OK ]
> [13:05:01] /usr/bin/gawk [ OK ]
> [13:05:01] /usr/bin/lwp-request [ Warning ]
> [13:05:01] Warning: The command '/usr/bin/lwp-request' has been replaced by
a script: /usr/bin/lwp-request: Perl script text executable
> [13:05:01] /usr/bin/locate.findutils [ OK ]
> [13:05:01] /usr/bin/kmod [ OK ]
> --
> [13:05:02] /usr/bin/which.debianutils [ OK ]
> [13:05:02] Info: Found file '/usr/bin/which.debianutils': it is whitelisted
for the 'script replacement' check.
> [13:05:02] /usr/bin/systemd [ Warning ]
> [13:05:02] Warning: The file properties have changed:
> [13:05:02] File: /usr/bin/systemd
> [13:05:02] Current hash:
ee6b3cfb7d27c0df5d75bb63de56ca5c912c3dbe9f4d35059dd35181f1c282d2
> --
> [13:05:02] Current file modification time: 1718531071 (16-juin-2024
11:44:31)
> [13:05:02] Stored file modification time : 1706305716
(26-janv.-2024 22:48:36)
> [13:05:02] /usr/bin/systemctl [ Warning ]
> [13:05:02] Warning: The file properties have changed:
> [13:05:02] File: /usr/bin/systemctl
> [13:05:02] Current hash:
4da401fbcd4690c1bd116460ef20d93d89fe5354dc0f0eae913e365a090706cc
> --
> [13:05:10] /usr/sbin/ifup [ OK ]
> [13:05:10] /usr/sbin/inetd [ OK ]
> [13:05:10] /usr/sbin/init [ Warning ]
> [13:05:10] Warning: The file properties have changed:
> [13:05:10] File: /usr/sbin/init
> [13:05:10] Current hash:
ee6b3cfb7d27c0df5d75bb63de56ca5c912c3dbe9f4d35059dd35181f1c282d2
> --
> [13:05:12] /usr/sbin/route [ OK ]
> [13:05:13] /usr/sbin/rsyslogd [ OK ]
> [13:05:13] /usr/sbin/runlevel [ Warning ]
> [13:05:13] Warning: The file properties have changed:
> [13:05:13] File: /usr/sbin/runlevel
> [13:05:13] Current hash:
4da401fbcd4690c1bd116460ef20d93d89fe5354dc0f0eae913e365a090706cc
> --
> [13:05:13] Current file modification time: 1718531071 (16-juin-2024
11:44:31)
> [13:05:13] Stored file modification time : 1706305716
(26-janv.-2024 22:48:36)
> [13:05:13] /usr/sbin/sshd [ Warning ]
> [13:05:13] Warning: The file properties have changed:
> [13:05:13] File: /usr/sbin/sshd
> [13:05:14] Current hash:
838332fe9777b307794760e1c4800b16ac17a93a2fe3f2580ceca8ca6ca2caa5
> --
> [13:05:15] /usr/sbin/unhide-posix [ OK ]
> [13:05:16] /usr/sbin/unhide-tcp [ OK ]
> [13:05:24] /usr/lib/systemd/systemd [ Warning ]
> [13:05:24] Warning: The file properties have changed:
> [13:05:24] File: /usr/lib/systemd/systemd
> [13:05:24] Current hash:
ee6b3cfb7d27c0df5d75bb63de56ca5c912c3dbe9f4d35059dd35181f1c282d2
> --
> [13:07:08] Info: Rkhunter option ALLOW_SSH_ROOT_USER set to 'no'.
> [13:07:08] Info: Rkhunter option ALLOW_SSH_PROT_V1 set to '2'.
> [13:07:09] Checking if SSH root access is allowed [ Warning ]
> [13:07:09] Warning: The SSH configuration option 'PermitRootLogin' has not
been set.
> The default value may be 'yes', to allow root access.
> [13:07:09] Checking if SSH protocol v1 is allowed [ Not set ]
> --
> [13:07:09] Info: SCAN_MODE_DEV set to 'THOROUGH'
> [13:07:13] Checking /dev for suspicious file types [ None found ]
> [13:07:13] Checking for hidden files and directories [ Warning ]
> [13:07:13] Warning: Hidden directory found: /etc/.java
> [13:07:13] Checking for missing log files [ Skipped ]
> [13:07:13] Info: No missing log file names configured.
>
>
>
> ----- Mail original -----
>
> > De: "ajh-valmer" <ajh.valmer@free.fr>
> > À: debian-user-french@lists.debian.org
> > Envoyé: Mardi 6 Août 2024 12:22:03
> > Objet: Re: [HS] Panne informatique mondiale
>
> > re Hello,
> > Je viens de faire un 2ème test avec "rkhunter" :
> > # rkhunter --checkhunter
> > Résultat :
> > "Checking if SSH root access is allowed [ Warning ]"
> > Une ligne de configuration dans sshd.conf à préciser,
> > mais ssh n'est pas lancé.
> > C'est tout.
> > Bilan : négatif, tout est OK sur un ordinateur ou la dernière fois
> > que j'ai lancé "rootkit" et "rkhunter" date de plusieurs années.
>
> > On Tuesday 06 August 2024 11:38:20 ajh-valmer wrote:
> > > Pas de panique, Warning :
> > > - /usr/lib/python3
> > > - /usr/lib/jvm/.java...
> > > - /usr/lib/debug/.build-id
> > > - /usr/lib/ruby
> > > - /usr/lib/hashcat/modules/.lock
> > > - /usr/lib/llvm-15/build
> > > - SNIFFER(/usr/sbin/NetworkManager : wpa_supplicant (Wifi)
> > > Et des suoppressions (deletion) en 2022 et le dernier en 28/09/2023
> > > Chez moi, j'ai quasi le même bilan.
> > > Rien de grave Docteur ? : non.
> > > Il y a souvent des faux positifs.
>
>
Reply to: