rkhunter - čo s výsledkom testu?

http://linuxos.sk/forum/22958/

>Akú varovnú / informačnú hodnotu to pre užívateľa má?

Jedná sa o informácie ktoré poukazujú na riziká.

>Ako voči tomu zareagovať?

Treba tie informácie prejsť a skontrolovať. V prípade jedinej ukážky (/usr/bin/unhide.rb) sa pri Ubuntu based distro môže jednať o false positive alarm. Či máš ale Mint založený na debiane alebo na Ubuntu nepíšeš, tak isto nepíšeš ani ako vyzerá daný log.



Takže, odpoveď ktorá by ti potvrdila či to môžeš zmiesť zo stola nebude.

Po instalacii LM 17.2 (ubuntu base) vypise rkhunter:

System checks summary
=====================

File properties checks...
    Files checked: 134
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 292
    Possible rootkits: 0

Applications checks...
    All checks skipped

The system checks took: 1 minute and 28 seconds

All results have been written to the log file (/var/log/rkhunter.log)

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)

Mna by zaujimali viac tie skryte subory - preco to pouzivaju:

[15:11:56] Info: Starting test name 'filesystem'
[15:11:56] Performing filesystem checks
[15:11:56] Info: SCAN_MODE_DEV set to 'THOROUGH'
[15:11:56]   Checking /dev for suspicious file types         [ Warning ]
[15:11:56] Warning: Suspicious file types found in /dev:
[15:11:56]          /dev/.udev/rules.d/root.rules: ASCII text
[15:11:57]   Checking for hidden files and directories       [ Warning ]
[15:11:57] Warning: Hidden directory found: '/etc/.java: directory '
[15:11:57] Warning: Hidden directory found: '/dev/.udev: directory '
[15:11:57] Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs' 
[15:12:09]
[15:12:09] Info: Test 'apps' disabled at users request.
[15:12:09]
[15:12:09] System checks summary
[15:12:09] =====================
[15:12:09]
[15:12:09] File properties checks...
[15:12:09] Files checked: 134
[15:12:09] Suspect files: 0
[15:12:09]
[15:12:09] Rootkit checks...
[15:12:09] Rootkits checked : 292
[15:12:09] Possible rootkits: 0

A po stiahnuti a instalacii aktualizacii ukazuje 27 podozrivych suborov.

[16:41:28] Info: Starting test name 'filesystem'
[16:41:28] Performing filesystem checks
[16:41:28] Info: SCAN_MODE_DEV set to 'THOROUGH'
[16:41:28]   Checking /dev for suspicious file types         [ Warning ]
[16:41:28] Warning: Suspicious file types found in /dev:
[16:41:28]          /dev/.udev/rules.d/root.rules: ASCII text
[16:41:28]   Checking for hidden files and directories       [ Warning ]
[16:41:28] Warning: Hidden directory found: '/etc/.java: directory '
[16:41:28] Warning: Hidden directory found: '/dev/.udev: directory '
[16:41:28] Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs' 
[16:41:32]
[16:41:32] Info: Test 'apps' disabled at users request.
[16:41:32]
[16:41:32] System checks summary
[16:41:32] =====================
[16:41:32]
[16:41:32] File properties checks...
[16:41:32] Files checked: 134
[16:41:32] Suspect files: 27
[16:41:32]
[16:41:32] Rootkit checks...
[16:41:32] Rootkits checked : 292
[16:41:32] Possible rootkits: 0
[16:41:32]
[16:41:32] Applications checks...
[16:41:32] All checks skipped
[16:41:32]
[16:41:32] The system checks took: 1 minute and 40 seconds
[16:41:32]
[16:41:32] Info: End date is Št aug 20 16:41:32 CEST 2015

Z toho jasne vyplyva, ze RKHunter upozornuje na vsetky zmenene subory.

Aj ktore sa stiahli ako aktualizacie, lebo boli oproti doterajsiemu stavu Zmenene.