No, pistetään välistä asiaa. Nyt kun on höpötetty näistä rootkiteistä niin tässä ohjeet miten voitte tarkistaa oman koneenne rootkitien varalta. Muistakaa pääsääntö, poistakaa sellaiset verkkopalvelut joita ette oikeasti tarvitse kuten ssh, apache, samba yms. jos ne ovat jotenkin päässeet asentumaan.
Kuitenkin tämä koneen rootkit-skannaus
1. Lataa skanneri täältä
http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.tar.gz?modtime=1190502076&big_mirror=0
2. Pura paketti haluamaasi esim. kotihakemistoon
3. Avaa pääte ja siirry uuteen ../rkhunter-1.3.0 hakemistoon
4. Komenna rootina (ts. sudo) "./installer.sh --layout default --install"
5. Asennuksen jälkeen komenna "rkhunter --propupd"
6. Lopuksi komenna "rkhunter --check" jolloin haittaohjelmien etsintä alkaa
7. Tulokset ovat luettavissa skannauksen aikana jos ehtii ja skannauksen päätyttyä hakemistosta /var/log/rkhunter.log jonka lukemiseen tarvitsee myös olla root
Eli koko ajan toimitaan rootina. README löytyy hakemistosta /rkhunter-1.3.0/files/README .
Lisätietoa saat tästä linkistä
http://www.rootkit.nl/projects/rootkit_hunter.html
Kuitenkin tämä koneen rootkit-skannaus
1. Lataa skanneri täältä
http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.tar.gz?modtime=1190502076&big_mirror=0
2. Pura paketti haluamaasi esim. kotihakemistoon
3. Avaa pääte ja siirry uuteen ../rkhunter-1.3.0 hakemistoon
4. Komenna rootina (ts. sudo) "./installer.sh --layout default --install"
5. Asennuksen jälkeen komenna "rkhunter --propupd"
6. Lopuksi komenna "rkhunter --check" jolloin haittaohjelmien etsintä alkaa
7. Tulokset ovat luettavissa skannauksen aikana jos ehtii ja skannauksen päätyttyä hakemistosta /var/log/rkhunter.log jonka lukemiseen tarvitsee myös olla root
Eli koko ajan toimitaan rootina. README löytyy hakemistosta /rkhunter-1.3.0/files/README .
Lisätietoa saat tästä linkistä
http://www.rootkit.nl/projects/rootkit_hunter.html
Vastaukset 25
Vanhimmat
Kokeilin tuota, ei löytynyt mitään.
Todella hyvät ohjeet meille aloittelijoille, siitä Kiitos exergy!
Tuo toimi hyvin Mint Celena:ssa. Odottelen tässä uutta ubuntua, kokeillen Minttiä.
tiedäx registerinputsausohelmia tai spywarepoisto?????????????????
Tästähän on ollut puhetta, löytyy hyvä skripti tuohon:
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=500000000000003&posting=22000000029653604
No älkää turhaan vaan ajako tuota ;D
Aina jäljessä. Tripwiren kaltainen systeemi on parempi.
ja tosi vainoharhainen asentaa rinnalle vielä Snortin.
http://www.snort.org
Niinhän se kai on, ensinnäkin softassa pitää olla päivitetyt tunnisteet malwarelle ja toisekseen jos sitä ajaa harvoin niin haitat ovat voineet jo tehdä tehtävänsä siinä vaiheessa kun seuraavan kerran skannaat mutta on tuo silti parempi kuin ei mitään, ainakin kotikäyttäjälle.
Sitäpaitsi myös tuo rkhunter voidaan hakkeroida niin ettei se tunnistakaan mitään, ainoa turvallinen tapa olisi buutata kone live-cd:ltä ja ajaa rkhunter cd:ltä käsin. Jos aikoo käyttää Tripwirea niin rkhunter tai/ja chkrootkit tulisi ajaa ennen Tripwiren asennusta (Chkrootkit on siis toinen samankaltainen ohjelma).
Onkohan tuo Logcheck samankaltainen kuin Tripwire? Ei ole tullut kokeiltua kumpaakaan.
Tämähän menee jo skitsoilun puolelle ;D no harvoin mitään tuollaisia tulee ajettua.
Olen "stealth" joten nukun yöni ihan rauhassa..
löytyy muuten paketinhallinnastakin tuo rkhunter. ei välttämättä uusin versio mut löytyypä kummiski.
Ihan näppärän oloinen ohjelma.
Hassu juttu muuten että ainakaan nyt tuonne rootkit.nl -sivustolle ei pääse. Linux-orjat hyökkää...?
osaako joku kertoa mitä nämä varoitukset tarkoittavat Fedora 8 3 test
[Press to continue]
Checking the local host...
Performing system boot checks
Checking for local host name [ Found ]
Checking for local startup files [ Found ]
Checking local startup files for malware [ None found ]
Checking system startup files for malware [ None found ]
Performing group and account checks
Checking for passwd file [ Found ]
Checking for root equivalent (UID 0) accounts [ None found ]
Checking for passwordless accounts [ None found ]
Checking for passwd file changes [ None found ]
Checking for group file changes [ None found ]
Checking root account shell history files [ OK ]
Performing system configuration file checks
Checking for SSH configuration file [ Found ]
Checking if SSH root access is allowed [ Warning ]
Checking if SSH protocol v1 is allowed [ Not allowed ]
Checking for running syslog daemon [ Found ]
Checking for syslog configuration file [ Warning ]
Performing filesystem checks
Checking /dev for suspicious file types [ Warning ]
Checking for hidden files and directories [ Warning ]
[Press to continue]
Checking application versions...
Checking version of GnuPG [ OK ]
Checking version of Apache [ OK ]
Checking version of OpenSSL [ OK ]
Checking version of Procmail MTA [ OK ]
Checking version of OpenSSH [ OK ]
System checks summary
=====================
File properties checks...
Files checked: 118
Suspect files: 5
Rootkit checks...
Rootkits checked : 79
Possible rootkits: 0
Applications checks...
Applications checked: 5
Suspect applications: 0
The system checks took: 5 minutes and 44 seconds
All results have been written to the logfile (/var/log/rkhunter.log)
One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)
Lähetä tiedosto /var/log/rkhunter.log tänne.
Yritin lukea ohjeet miten saan näkyviin login mikä käsky että voin lukea.
Sorry yritin vanhasta Red Hatin kirjasta mutta en löydä.
Kiitos vastauksesta.
[20:24:27] Checking for file '/bin/host.ph1' [ Not found ]
[20:24:27] Checking for file '/usr/share/.home.ph1/phalanx' [ Not found ]
[20:24:27] Checking for directory '/usr/share/.home.ph1' [ Not found ]
[20:24:27] Phalanx Rootkit [ Not found ]
[20:24:27]
[20:24:27] Checking for Phalanx Rootkit (strings)...
[20:24:27] Checking for string 'phalanx' [ Not found ]
[20:24:27] Phalanx Rootkit (strings) [ Not found ]
[20:24:28]
[20:24:28] Checking for Portacelo Rootkit...
[20:24:28] Checking for file '/var/lib/.../.ak' [ Not found ]
[20:24:28] Checking for file '/var/lib/.../.hk' [ Not found ]
[20:24:28] Checking for file '/var/lib/.../.rs' [ Not found ]
[20:24:28] Checking for file '/var/lib/.../.p' [ Not found ]
[20:24:28] Checking for file '/var/lib/.../getty' [ Not found ]
[20:24:28] Checking for file '/var/lib/.../lkt.o' [ Not found ]
[20:24:29] Checking for file '/var/lib/.../show' [ Not found ]
[20:24:29] Checking for file '/var/lib/.../nlkt.o' [ Not found ]
[20:24:29] Checking for file '/var/lib/.../ssshrc' [ Not found ]
[20:24:29] Checking for file '/var/lib/.../sssh_equiv' [ Not found ]
[20:24:29] Checking for file '/var/lib/.../sssh_known_hosts' [ Not found ]
[20:24:29] Checking for file '/var/lib/.../sssh_pid' [ Not found ]
[20:24:29] Checking for file '~/.sssh/known_hosts' [ Not found ]
[20:24:29] Portacelo Rootkit [ Not found ]
[20:24:30]
[20:24:30] Checking for R3dstorm Toolkit...
[20:24:30] Checking for file '/var/log/tk02/see_all' [ Not found ]
[20:24:30] Checking for file '/bin/.../sshd/sbin/sshd1' [ Not found ]
[20:24:30] Checking for file '/bin/.../hate/sk' [ Not found ]
[20:24:30] Checking for file '/bin/.../see_all' [ Not found ]
[20:24:30] Checking for directory '/var/log/tk02' [ Not found ]
[20:24:30] Checking for directory '/var/log/tk02/old' [ Not found ]
[20:24:31] Checking for directory '/bin/...' [ Not found ]
[20:24:31] R3dstorm Toolkit [ Not found ]
[20:24:31]
[20:24:31] Checking for RH-Sharpe's Rootkit...
[20:24:31] Checking for file '/bin/lps' [ Not found ]
[20:24:31] Checking for file '/usr/bin/lpstree' [ Not found ]
[20:24:31] Checking for file '/usr/bin/ltop' [ Not found ]
[20:24:31] Checking for file '/usr/bin/lkillall' [ Not found ]
[20:24:31] Checking for file '/usr/bin/ldu' [ Not found ]
[20:24:32] Checking for file '/usr/bin/lnetstat' [ Not found ]
[20:24:32] Checking for file '/usr/bin/wp' [ Not found ]
[20:24:32] Checking for file '/usr/bin/shad' [ Not found ]
[20:24:32] Checking for file '/usr/bin/vadim' [ Not found ]
[20:24:32] Checking for file '/usr/bin/slice' [ Not found ]
[20:24:32] Checking for file '/usr/bin/cleaner' [ Not found ]
[20:24:32] Checking for file '/usr/include/rpcsvc/du' [ Not found ]
[20:24:33] RH-Sharpe's Rootkit [ Not found ]
[20:24:33]
[20:24:33] Checking for RSHA's Rootkit...
[20:24:33] Checking for file '/bin/kr4p' [ Not found ]
[20:24:33] Checking for file '/usr/bin/n3tstat' [ Not found ]
[20:24:33] Checking for file '/usr/bin/chsh2' [ Not found ]
[20:24:33] Checking for file '/usr/bin/slice2' [ Not found ]
[20:24:33] Checking for file '/usr/src/linux/arch/alpha/lib/.lib/.1proc' [ Not found ]
[20:24:33] Checking for file '/etc/rc.d/arch/alpha/lib/.lib/.1addr' [ Not found ]
[20:24:34] Checking for directory '/etc/rc.d/rsha' [ Not found ]
[20:24:34] Checking for directory '/etc/rc.d/arch/alpha/lib/.lib' [ Not found ]
[20:24:34] RSHA's Rootkit [ Not found ]
[20:24:34]
[20:24:34] Checking for Scalper Worm...
[20:24:34] Checking for file '/tmp/.a' [ Not found ]
[20:24:34] Checking for file '/tmp/.uua' [ Not found ]
[20:24:34] Scalper Worm [ Not found ]
[20:24:35]
[20:24:35] Checking for Sebek LKM...
[20:24:35] Checking for kernel symbol 'adore or sebek' [ Not found ]
[20:24:35] Sebek LKM [ Not found ]
[20:24:36]
[20:24:36] Checking for Shutdown Rootkit...
[20:24:36] Checking for file '/usr/man/man5/.. /.dir/scannah/asus' [ Not found ]
[20:24:36] Checking for file '/usr/man/man5/.. /.dir/see' [ Not found ]
[20:24:36] Checking for file '/usr/man/man5/.. /.dir/nscd' [ Not found ]
[20:24:36] Checking for file '/usr/man/man5/.. /.dir/alpd' [ Not found ]
[20:24:36] Checking for file '/etc/rc.d/rc.local ' [ Not found ]
[20:24:36] Checking for directory '/usr/man/man5/.. /.dir' [ Not found ]
[20:24:36] Checking for directory '/usr/man/man5/.. /.dir/scannah' [ Not found ]
[20:24:37] Checking for directory '/etc/rc.d/rc0.d/.. /.dir' [ Not found ]
[20:24:37] Shutdown Rootkit [ Not found ]
[20:24:37]
[20:24:37] Checking for SHV4 Rootkit...
[20:24:37] Checking for file '/etc/ld.so.hash' [ Not found ]
[20:24:37] Checking for file '/lib/libext-2.so.7' [ Not found ]
[20:24:37] Checking for file '/lib/lidps1.so' [ Not found ]
[20:24:37] Checking for file '/usr/sbin/xntps' [ Not found ]
[20:24:38] Checking for directory '/lib/security/.config' [ Not found ]
[20:24:38] Checking for directory '/lib/security/.config/ssh' [ Not found ]
[20:24:38] SHV4 Rootkit [ Not found ]
[20:24:38]
[20:24:38] Checking for SHV5 Rootkit...
[20:24:38] Checking for file '/etc/sh.conf' [ Not found ]
[20:24:38] Checking for file '/dev/srd0' [ Not found ]
[20:24:38] Checking for directory '/usr/lib/libsh' [ Not found ]
[20:24:38] SHV5 Rootkit [ Not found ]
[20:24:39]
[20:24:39] Checking for Sin Rootkit...
[20:24:39] Checking for file '/dev/.haos/haos1/.f/Denyed' [ Not found ]
[20:24:39] Checking for file '/dev/ttyoa' [ Not found ]
[20:24:39] Checking for file '/dev/ttyof' [ Not found ]
[20:24:39] Checking for file '/dev/ttyop' [ Not found ]
[20:24:39] Checking for file '/dev/ttyos' [ Not found ]
[20:24:39] Checking for file '/usr/lib/.lib' [ Not found ]
[20:24:40] Checking for file '/usr/lib/sn/.X' [ Not found ]
[20:24:40] Checking for file '/usr/lib/sn/.sys' [ Not found ]
[20:24:40] Checking for file '/usr/lib/ld/.X' [ Not found ]
[20:24:40] Checking for file '/usr/man/man1/...' [ Not found ]
[20:24:40] Checking for file '/usr/man/man1/.../.m' [ Not found ]
[20:24:40] Checking for file '/usr/man/man1/.../.w' [ Not found ]
[20:24:40] Checking for directory '/usr/lib/sn' [ Not found ]
[20:24:41] Checking for directory '/usr/lib/man1/...' [ Not found ]
[20:24:41] Checking for directory '/dev/.haos' [ Not found ]
[20:24:41] Sin Rootkit [ Not found ]
[20:24:41]
[20:24:41] Checking for Slapper Worm...
[20:24:41] Checking for file '/tmp/.bugtraq' [ Not found ]
[20:24:41] Checking for file '/tmp/.uubugtraq' [ Not found ]
[20:24:41] Checking for file '/tmp/.bugtraq.c' [ Not found ]
[20:24:41] Checking for file '/tmp/httpd' [ Not found ]
[20:24:42] Checking for file '/tmp/.unlock' [ Not found ]
[20:24:42] Checking for file '/tmp/update' [ Not found ]
[20:24:42] Checking for file '/tmp/.cinik' [ Not found ]
[20:24:42] Checking for file '/tmp/.b' [ Not found ]
[20:24:42] Slapper Worm [ Not found ]
[20:24:42]
[20:24:42] Checking for Sneakin Rootkit...
[20:24:42] Checking for directory '/tmp/.X11-unix/.../rk' [ Not found ]
[20:24:43] Sneakin Rootkit [ Not found ]
[20:24:43]
[20:24:43] Checking for Suckit Rootkit...
[20:24:43] Checking for file '/sbin/initsk12' [ Not found ]
[20:24:43] Checking for file '/sbin/initxrk' [ Not found ]
[20:24:43] Checking for file '/usr/bin/null' [ Not found ]
[20:24:43] Checking for file '/usr/share/locale/sk/.sk12/sk' [ Not found ]
[20:24:43] Checking for file '/etc/rc.d/rc0.d/S23kmdac' [ Not found ]
[20:24:44] Checking for file '/etc/rc.d/rc1.d/S23kmdac' [ Not found ]
[20:24:44] Checking for file '/etc/rc.d/rc2.d/S23kmdac' [ Not found ]
[20:24:44] Checking for file '/etc/rc.d/rc3.d/S23kmdac' [ Not found ]
[20:24:44] Checking for file '/etc/rc.d/rc4.d/S23kmdac' [ Not found ]
[20:24:44] Checking for file '/etc/rc.d/rc5.d/S23kmdac' [ Not found ]
[20:24:44] Checking for file '/etc/rc.d/rc6.d/S23kmdac' [ Not found ]
[20:24:44] Checking for directory '/dev/sdhu0/tehdrakg' [ Not found ]
[20:24:44] Checking for directory '/etc/.MG' [ Not found ]
[20:24:45] Checking for directory '/usr/share/locale/sk/.sk12' [ Not found ]
[20:24:45] Checking for directory '/usr/lib/perl5/site_perl/i386-linux/auto/TimeDate/.packlist' [ Not found ]
[20:24:45] Suckit Rootkit [ Not found ]
[20:24:45]
[20:24:45] Checking for SunOS Rootkit...
[20:24:45] Checking for file '/etc/ld.so.hash' [ Not found ]
[20:24:45] Checking for file '/lib/libext-2.so.7' [ Not found ]
[20:24:45] Checking for file '/usr/bin/ssh2d' [ Not found ]
[20:24:46] Checking for file '/bin/xlogin' [ Not found ]
[20:24:46] Checking for file '/usr/lib/crth.o' [ Not found ]
[20:24:46] Checking for file '/usr/lib/crtz.o' [ Not found ]
[20:24:46] Checking for file '/sbin/login' [ Not found ]
[20:24:46] Checking for file '/lib/security/.config/sn' [ Not found ]
[20:24:46] Checking for file '/lib/security/.config/lpsched' [ Not found ]
[20:24:46] Checking for file '/dev/kmod' [ Not found ]
[20:24:46] Checking for file '/dev/dos' [ Not found ]
[20:24:47] SunOS Rootkit [ Not found ]
[20:24:47]
[20:24:47] Checking for SunOS / NSDAP Rootkit...
[20:24:47] Checking for file '/usr/lib/vold/nsdap/.kit' [ Not found ]
[20:24:47] Checking for file '/usr/lib/vold/nsdap/defines' [ Not found ]
[20:24:47] Checking for file '/usr/lib/vold/nsdap/patcher' [ Not found ]
[20:24:47] Checking for file '/usr/lib/vold/nsdap/pg' [ Not found ]
[20:24:47] Checking for file '/usr/lib/vold/nsdap/cleaner' [ Not found ]
[20:24:48] Checking for file '/usr/lib/vold/nsdap/utime' [ Not found ]
[20:24:48] Checking for file '/usr/lib/vold/nsdap/crypt' [ Not found ]
[20:24:48] Checking for file '/usr/lib/vold/nsdap/findkit' [ Not found ]
[20:24:48] Checking for file '/usr/lib/vold/nsdap/sn2' [ Not found ]
[20:24:48] Checking for file '/usr/lib/vold/nsdap/sniffload' [ Not found ]
[20:24:48] Checking for file '/usr/lib/vold/nsdap/runsniff' [ Not found ]
[20:24:48] Checking for file '/usr/lib/lpset' [ Not found ]
[20:24:48] Checking for directory '/usr/lib/vold/nsdap' [ Not found ]
[20:24:49] SunOS / NSDAP Rootkit [ Not found ]
[20:24:49]
[20:24:49] Checking for Superkit Rootkit...
[20:24:49] Checking for file '/usr/man/.sman/sk' [ Not found ]
[20:24:49] Superkit Rootkit [ Not found ]
[20:24:49]
[20:24:49] Checking for TBD (Telnet BackDoor)...
[20:24:49] Checking for file '/usr/lib/.tbd' [ Not found ]
[20:24:49] TBD (Telnet BackDoor) [ Not found ]
[20:24:50]
[20:24:50] Checking for TeLeKiT Rootkit...
[20:24:50] Checking for file '/usr/man/man3/.../TeLeKiT/bin/sniff' [ Not found ]
[20:24:50] Checking for file '/usr/man/man3/.../TeLeKiT/bin/telnetd' [ Not found ]
[20:24:50] Checking for file '/usr/man/man3/.../TeLeKiT/bin/teleulo' [ Not found ]
[20:24:50] Checking for file '/usr/man/man3/.../cl' [ Not found ]
[20:24:50] Checking for file '/dev/ptyr' [ Not found ]
[20:24:50] Checking for file '/dev/ptyp' [ Not found ]
[20:24:50] Checking for file '/dev/ptyq' [ Not found ]
[20:24:51] Checking for file '/dev/hda06' [ Not found ]
[20:24:51] Checking for file '/usr/info/libc1.so' [ Not found ]
[20:24:51] Checking for directory '/usr/man/man3/...' [ Not found ]
[20:24:51] Checking for directory '/usr/man/man3/.../lsniff' [ Not found ]
[20:24:51] Checking for directory '/usr/man/man3/.../TeLeKiT' [ Not found ]
[20:24:51] TeLeKiT Rootkit [ Not found ]
[20:24:51]
[20:24:51] Checking for T0rn Rootkit...
[20:24:52] Checking for file '/dev/.lib/lib/lib/t0rns' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/du' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/ls' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/t0rnsb' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/ps' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/t0rnp' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/find' [ Not found ]
[20:24:52] Checking for file '/dev/.lib/lib/lib/ifconfig' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/pg' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/ssh.tgz' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/top' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/sz' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/login' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/in.fingerd' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/1i0n.sh' [ Not found ]
[20:24:53] Checking for file '/dev/.lib/lib/lib/pstree' [ Not found ]
[20:24:54] Checking for file '/dev/.lib/lib/lib/in.telnetd' [ Not found ]
[20:24:54] Checking for file '/dev/.lib/lib/lib/mjy' [ Not found ]
[20:24:54] Checking for file '/dev/.lib/lib/lib/sush' [ Not found ]
[20:24:54] Checking for file '/dev/.lib/lib/lib/tfn' [ Not found ]
[20:24:54] Checking for file '/dev/.lib/lib/lib/name' [ Not found ]
[20:24:54] Checking for file '/dev/.lib/lib/lib/getip.sh' [ Not found ]
[20:24:54] Checking for file '/usr/info/.torn/sh*' [ Not found ]
[20:24:55] Checking for file '/usr/src/.puta/.1addr' [ Not found ]
[20:24:55] Checking for file '/usr/src/.puta/.1file' [ Not found ]
[20:24:55] Checking for file '/usr/src/.puta/.1proc' [ Not found ]
[20:24:55] Checking for file '/usr/src/.puta/.1logz' [ Not found ]
[20:24:55] Checking for file '/usr/info/.t0rn' [ Not found ]
[20:24:55] Checking for directory '/dev/.lib' [ Not found ]
[20:24:55] Checking for directory '/dev/.lib/lib' [ Not found ]
[20:24:55] Checking for directory '/dev/.lib/lib/lib' [ Not found ]
[20:24:56] Checking for directory '/dev/.lib/lib/lib/dev' [ Not found ]
[20:24:56] Checking for directory '/dev/.lib/lib/scan' [ Not found ]
[20:24:56] Checking for directory '/usr/src/.puta' [ Not found ]
[20:24:56] Checking for directory '/usr/man/man1/man1' [ Not found ]
[20:24:56] Checking for directory '/usr/man/man1/man1/lib' [ Not found ]
[20:24:56] Checking for directory '/usr/man/man1/man1/lib/.lib' [ Not found ]
[20:24:56] Checking for directory '/usr/man/man1/man1/lib/.lib/.backup' [ Not found ]
[20:24:57] T0rn Rootkit [ Not found ]
[20:24:57]
[20:24:57] Checking for Trojanit Kit...
[20:24:57] Checking for file '/bin/.ls' [ Not found ]
[20:24:57] Checking for file '/bin/.ps' [ Not found ]
[20:24:57] Checking for file '/bin/.netstat' [ Not found ]
[20:24:57] Checking for file '/usr/bin/.nop' [ Not found ]
[20:24:57] Checking for file '/usr/bin/.who' [ Not found ]
[20:24:57] Trojanit Kit [ Not found ]
[20:24:58]
[20:24:58] Checking for Tuxtendo Rootkit...
[20:24:58] Checking for file '/dev/tux/.addr' [ Not found ]
[20:24:58] Checking for file '/dev/tux/.cron' [ Not found ]
[20:24:58] Checking for file '/dev/tux/.file' [ Not found ]
[20:24:58] Checking for file '/dev/tux/.log' [ Not found ]
[20:24:58] Checking for file '/dev/tux/.proc' [ Not found ]
[20:24:58] Checking for file '/dev/tux/backup/crontab' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/df' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/dir' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/find' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/ifconfig' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/locate' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/netstat' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/ps' [ Not found ]
[20:24:59] Checking for file '/dev/tux/backup/pstree' [ Not found ]
[20:25:00] Checking for file '/dev/tux/backup/syslogd' [ Not found ]
[20:25:00] Checking for file '/dev/tux/backup/tcpd' [ Not found ]
[20:25:00] Checking for file '/dev/tux/backup/top' [ Not found ]
[20:25:00] Checking for file '/dev/tux/backup/updatedb' [ Not found ]
[20:25:00] Checking for file '/dev/tux/backup/vdir' [ Not found ]
[20:25:00] Checking for directory '/dev/tux' [ Not found ]
[20:25:00] Checking for directory '/dev/tux/ssh2' [ Not found ]
[20:25:01] Checking for directory '/dev/tux/backup' [ Not found ]
[20:25:01] Tuxtendo Rootkit [ Not found ]
[20:25:01]
[20:25:01] Checking for URK Rootkit...
[20:25:01] Checking for file '/usr/man/man1/xxxxxxbin/find' [ Not found ]
[20:25:01] Checking for file '/usr/man/man1/xxxxxxbin/du' [ Not found ]
[20:25:01] Checking for file '/usr/man/man1/xxxxxxbin/ps' [ Not found ]
[20:25:01] Checking for file '/tmp/conf.inf' [ Not found ]
[20:25:02] Checking for directory '/usr/man/man1/xxxxxxbin' [ Not found ]
[20:25:02] URK Rootkit [ Not found ]
[20:25:02]
[20:25:02] Checking for VcKit Rootkit...
[20:25:02] Checking for directory '/usr/include/linux/modules/lib.so' [ Not found ]
[20:25:02] Checking for directory '/usr/include/linux/modules/lib.so/bin' [ Not found ]
[20:25:02] VcKit Rootkit [ Not found ]
[20:25:02]
[20:25:02] Checking for Volc Rootkit...
[20:25:02] Checking for directory '/var/spool/.recent' [ Not found ]
[20:25:03] Checking for directory '/var/spool/.recent/.files' [ Not found ]
[20:25:03] Checking for directory '/usr/lib/volc' [ Not found ]
[20:25:03] Checking for directory '/usr/lib/volc/backup' [ Not found ]
[20:25:03] Volc Rootkit [ Not found ]
[20:25:03]
[20:25:03] Checking for X-Org SunOS Rootkit...
[20:25:03] Checking for file '/usr/lib/libX.a/bin/tmpfl' [ Not found ]
[20:25:03] Checking for file '/usr/lib/libX.a/bin/rps' [ Not found ]
[20:25:04] Checking for file '/usr/bin/srload' [ Not found ]
[20:25:04] Checking for file '/usr/lib/libX.a/bin/sparcv7/rps' [ Not found ]
[20:25:04] Checking for file '/usr/sbin/modcheck' [ Not found ]
[20:25:04] Checking for directory '/usr/lib/libX.a' [ Not found ]
[20:25:04] Checking for directory '/usr/lib/libX.a/bin' [ Not found ]
[20:25:04] Checking for directory '/usr/lib/libX.a/bin/sparcv7' [ Not found ]
[20:25:04] Checking for directory '/usr/share/man...' [ Not found ]
[20:25:04] X-Org SunOS Rootkit [ Not found ]
[20:25:05]
[20:25:05] Checking for zaRwT.KiT Rootkit...
[20:25:05] Checking for file '/dev/rd/s/sendmeil' [ Not found ]
[20:25:05] Checking for file '/dev/ttyf' [ Not found ]
[20:25:05] Checking for file '/dev/ttyp' [ Not found ]
[20:25:05] Checking for file '/dev/ttyn' [ Not found ]
[20:25:05] Checking for file '/rk/tulz' [ Not found ]
[20:25:05] Checking for directory '/rk' [ Not found ]
[20:25:06] Checking for directory '/dev/rd/s' [ Not found ]
[20:25:06] zaRwT.KiT Rootkit [ Not found ]
[20:25:06]
[20:25:06] Performing additional rootkit checks
[20:25:06] Info: Starting test name 'additional_rkts'
[20:25:06]
[20:25:06] Performing Suckit Rookit additional checks
[20:25:06] Checking /sbin/init link count [ OK ]
[20:25:06] Checking for hidden file extensions [ None found ]
[20:25:07] Running skdet command [ Skipped ]
[20:25:07] Info: Unable to find the 'skdet' command
[20:25:07] Suckit Rookit additional checks [ OK ]
[20:25:07]
[20:25:07] Performing check of possible rootkit files and directories
[20:25:07] Info: Starting test name 'possible_rkt_files'
[20:25:07] Checking for file '/dev/sdr0' [ Not found ]
[20:25:07] Checking for file '/tmp/.syshackfile' [ Not found ]
[20:25:08] Checking for file '/tmp/.bash_history' [ Not found ]
[20:25:08] Checking for file '/usr/info/.clib' [ Not found ]
[20:25:08] Checking for file '/usr/sbin/tcp.log' [ Not found ]
[20:25:08] Checking for file '/usr/bin/take/pid' [ Not found ]
[20:25:08] Checking for file '/sbin/create' [ Not found ]
[20:25:09] Checking for file '/dev/ttypz' [ Not found ]
[20:25:09] Checking for directory '/usr/bin/take' [ Not found ]
[20:25:09] Checking for directory '/usr/src/.lib' [ Not found ]
[20:25:09] Checking for directory '/usr/share/man/man1/.1c' [ Not found ]
[20:25:09] Checking for directory '/lib/lblip.tk' [ Not found ]
[20:25:09] Checking for directory '/usr/sbin/...' [ Not found ]
[20:25:10] Checking for directory '/usr/share/.gun' [ Not found ]
[20:25:10] Checking for possible rootkit files and directories [ None found ]
[20:25:10]
[20:25:10] Performing check for possible rootkit strings
[20:25:10] Info: Starting test name 'possible_rkt_strings'
[20:25:10] Checking for possible rootkit strings [ Skipped ]
[20:25:10] Info: Unable to find the 'strings' command
[20:25:10]
[20:25:10] Performing malware checks
[20:25:11] Info: Starting test name 'malware'
[20:25:11]
[20:25:11] Info: Test 'deleted_files' disabled at users request.
[20:25:11] Info: Starting test name 'running_procs'
[20:25:12] Checking running processes for suspicious files [ None found ]
[20:25:13]
[20:25:13] Info: Test 'hidden_procs' disabled at users request.
[20:25:13]
[20:25:13] Info: Test 'suspscan' disabled at users request.
[20:25:13]
[20:25:13] Performing check for login backdoors
[20:25:13] Info: Starting test name 'other_malware'
[20:25:13] Checking for '/bin/.login' [ Not found ]
[20:25:13] Checking for '/sbin/.login' [ Not found ]
[20:25:13] Checking for login backdoors [ None found ]
[20:25:13]
[20:25:13] Performing check for suspicious directories
[20:25:13] Checking for directory '/usr/X11R6/bin/.,/copy' [ Not found ]
[20:25:14] Checking for directory '/dev/rd/cdb' [ Not found ]
[20:25:14] Checking for suspicious directories [ None found ]
[20:25:14]
[20:25:14] Checking for software intrusions [ Skipped ]
[20:25:14] Info: Check skipped - tripwire not installed
[20:25:14]
[20:25:14] Performing check for sniffer log files
[20:25:14] Checking for file '/usr/lib/libice.log' [ Not found ]
[20:25:14] Checking for sniffer log files [ None found ]
[20:25:15]
[20:25:15] Performing trojan specific checks
[20:25:15] Info: Starting test name 'trojans'
[20:25:15] Checking for enabled inetd services [ Skipped ]
[20:25:15] Info: Check skipped - file '/etc/inetd.conf' does not exist.
[20:25:15]
[20:25:15] Performing check for enabled xinetd services
[20:25:15] Checking for enabled xinetd services [ Skipped ]
[20:25:15] Info: Check skipped - file '/etc/xinetd.conf' does not exist.
[20:25:15] Checking for Apache backdoor [ Not found ]
[20:25:16]
[20:25:16] Performing Linux specific checks
[20:25:16] Info: Starting test name 'os_specific'
[20:25:16] Checking kernel module commands [ OK ]
[20:25:16] Info: Using modules pathname of '/lib/modules/2.6.23-5.fc8'
[20:25:17] Checking kernel module names [ OK ]
[20:25:23]
[20:25:23] Checking the network...
[20:25:23] Info: Starting test name 'network'
[20:25:24] Info: Starting test name 'ports'
[20:25:24]
[20:25:24] Performing check for backdoor ports
[20:25:24] Checking for UDP port 2001 [ Not found ]
[20:25:25] Checking for TCP port 2006 [ Not found ]
[20:25:26] Checking for TCP port 2128 [ Not found ]
[20:25:27] Checking for TCP port 14856 [ Not found ]
[20:25:28] Checking for TCP port 47107 [ Not found ]
[20:25:29] Checking for TCP port 60922 [ Not found ]
[20:25:29]
[20:25:29] Performing checks on the network interfaces
[20:25:29] Info: Starting test name 'promisc'
[20:25:29] Checking for promiscuous interfaces [ None found ]
[20:25:29]
[20:25:29] Info: Test 'packet_cap_apps' disabled at users request.
[20:25:32]
[20:25:32] Checking the local host...
[20:25:32] Info: Starting test name 'local_host'
[20:25:33]
[20:25:33] Performing system boot checks
[20:25:33] Info: Starting test name 'startup_files'
[20:25:33] Checking for local host name [ Found ]
[20:25:33] Info: Starting test name 'startup_malware'
[20:25:33] Info: Found local startup file: /etc/rc.d/rc.local
[20:25:33] Info: Found local startup file: /etc/rc.d/rc.sysinit
[20:25:33] Info: Found local startup file: /etc/inittab
[20:25:33] Checking for local startup files [ Found ]
[20:25:34] Checking local startup files for malware [ None found ]
[20:25:34] Info: Found system startup directory: /etc/rc.d
[20:25:38] Checking system startup files for malware [ None found ]
[20:25:38]
[20:25:38] Performing group and account checks
[20:25:38] Info: Starting test name 'group_accounts'
[20:25:39] Checking for passwd file [ Found ]
[20:25:39] Info: Found password file: /etc/passwd
[20:25:39] Checking for root equivalent (UID 0) accounts [ None found ]
[20:25:39] Info: Found shadow file: /etc/shadow
[20:25:39] Checking for passwordless accounts [ None found ]
[20:25:39] Info: Starting test name 'passwd_changes'
[20:25:40] Checking for passwd file changes [ None found ]
[20:25:40] Info: Starting test name 'group_changes'
[20:25:40] Checking for group file changes [ None found ]
[20:25:40] Checking root account shell history files [ OK ]
[20:25:40]
[20:25:40] Performing system configuration file checks
[20:25:41] Info: Starting test name 'system_configs'
[20:25:41] Checking for SSH configuration file [ Found ]
[20:25:41] Info: Found SSH configuration file: /etc/ssh/sshd_config
[20:25:41] Info: Rkhunter option ALLOW_SSH_ROOT_USER set to 'no'.
[20:25:41] Checking if SSH root access is allowed [ Warning ]
[20:25:41] Warning: The SSH configuration option 'PermitRootLogin' has not been set.
The default value may be 'yes', to allow root access.
[20:25:41] Checking if SSH protocol v1 is allowed [ Not allowed ]
[20:25:42] Checking for running syslog daemon [ Found ]
[20:25:42] Checking for syslog configuration file [ Warning ]
[20:25:42] Warning: The syslog daemon is running, but no configuration file can be found.
[20:25:42]
[20:25:42] Performing filesystem checks
[20:25:42] Info: Starting test name 'filesystem'
[20:25:42] Info: SCAN_MODE_DEV set to 'THOROUGH'
[20:26:01] Checking /dev for suspicious file types [ Warning ]
[20:26:01] Warning: Suspicious files found in /dev:
[20:26:01] /dev/shm/pulse-shm-3879426477: data
[20:26:02] Checking for hidden files and directories [ Warning ]
[20:26:02] Warning: Hidden directory found: /dev/.udev
[20:26:02] Warning: Hidden file found: /usr/share/man/man1/..1.gz: gzip compressed data, from Unix, max compression
[20:27:41]
[20:27:41] Checking application versions...
[20:27:41] Info: Starting test name 'apps'
[20:27:43] Info: Application 'exim' not found.
[20:27:43] Checking version of GnuPG [ OK ]
[20:27:43] Info: Application 'gpg' version '1.4.7' found.
[20:27:43] Checking version of Apache [ OK ]
[20:27:44] Info: Application 'httpd' version '2.2.6' found.
[20:27:44] Info: Application 'named' not found.
[20:27:44] Checking version of OpenSSL [ OK ]
[20:27:44] Info: Application 'openssl' version '0.9.8b' found.
[20:27:44] Info: Application 'php' not found.
[20:27:44] Checking version of Procmail MTA [ OK ]
[20:27:44] Info: Application 'procmail' version '3.22' found.
[20:27:45] Info: Application 'proftpd' not found.
[20:27:45] Checking version of OpenSSH [ OK ]
[20:27:45] Info: Application 'sshd' version '4.7p1' found.
[20:27:45] Info: Applications checked: 5 out of 9
[20:27:45]
[20:27:45] System checks summary
[20:27:45] =====================
[20:27:45]
[20:27:45] File properties checks...
[20:27:45] Files checked: 118
[20:27:46] Suspect files: 5
[20:27:46]
[20:27:46] Rootkit checks...
[20:27:46] Rootkits checked : 79
[20:27:46] Possible rootkits: 0
[20:27:46]
[20:27:46] Applications checks...
[20:27:46] Applications checked: 5
[20:27:46] Suspect applications: 0
[20:27:46]
[20:27:46] The system checks took: 5 minutes and 44 seconds
[20:27:47]
[20:27:47] Info: End date is to 11.10.2007 20:27:47 0300
/etc/ssh/sshd.conf -tiedostosta muuta rivi:
PermitRootLogin yes
muotoon:
PermitRootLogin no
tai lisää se tiedostoon, jos sitä ei vielä siellä ole. Jos et tarvitse ssh:ta, se kannattaa sammuttaa tai asettaa kuuntelemaan jotain muuta porttia kuin 22. Sshd.conf -tiedostossa voi myös määrittää käyttäjät, jotka saavat kirjautua koneelle ssh:lla lisäämällä tiedostoon rivi:
AllowUsers 1.tunnus 2.tunnus
/usr/share/man/man1/ -hakemistosta löytyy piilotiedosto. Se/sen sisältö kannattaa tutkia.
Piilotiedostot /dev/ -hakemistossa eivät tässä tapauksessa ole vaarallisia.
Ajatko kaikkea roottina, kun noin pelottelet ihmisiä. Jos sinulla on oikein konffattu palomuuri etkä aja ko juttuja roottina ei kannata päätää tällä vaivata. Höpö höpö.
Kiitos vastanneille
Mihin Debianissa muuria tarvitaan?
Jätä muuri pois ja katsele lokeja, kyllä yrittäjiä riittää.
naarattaa nii että tulloo pissa housuu
"Ajatko kaikkea roottina"
Ubuntussa? No en todellakaan vaan ihan perus-user-sudona. Root ja Rootkit ovat eri asia, Rootkit voi tulla vaikka olisit pelkkä user, siihen riittää heikko ssh.
Myönnettäköön että root-tili on aktivoitu mutta en usko että kukaan pääsee sinne ulkopuolelta, olen "stealth" eli näkymätön ulkopuolelle enkä käytä root-tiliä kuin todella harvoin vikatilanteissa.
"Stealth" -tilasta ei ole hyötyä, jos käytät verkkoa esim. nettiselaimella. Koneesi kyllä löydetään jos joku sen haluaa löytää.
Mitä tahansa verkon palvelua käytänkin niin joudun ottamaan yhteyttä verkoon, eipä siinä mitään. Mutta kun kone on NATin takana et voi mitenkään päästä niihin kiinni jos DNS ei ole määritelty eikä mitään palveluita ole tarjolla. Pääset vain mun modeemiin saakka ja siihen jäät.
Asennuksessa joka kodassa OK mutta
# rkhunter --propupd
Tämmösen pukkaa, bash: /usr/local/bin/rkhunter: Permission denied
# rkhunter --check
bash: /usr/local/bin/rkhunter: Permission denied
/var/log/rkhunter.log kansiota ei ole laisinkaan.
Mittee ny pittää tehä?