0 Kommentare

Sehr geehrter Herr Kleeman,

wie in Ausgabe August 2014 des Linux-Insiders beschrieben, habe ich meinen PC mit „rkhunter“ und „chkrootkit“ überprüft. Das Ergebnis ist in der Anlage (auszugsweise) beschrieben.
Rkhunter gibt zwar einige Warnungen aus, ansonsten sagt das Tool: „Possible Rootkits: None“.
Chkrootkit warnt, dass „/sbin/init/“ infiziert ist (Suckit Rootkit).

Meine Fragen:
1. Sind die Warnungen zu beachten/ kritisch?
2. Wie gehe ich mit dem Ergebnis von chkrootkit um?

Vielleicht haben Sie einen Tipp…
Mit freundlichen Grüßen
Alamogordo

1. Ergebnis mit rkhunter, Version 1.4.0

/usr/sbin/rsyslogd [ Warning ]
[14:11:06] Warning: The file properties have changed:
[14:11:06] File: /usr/sbin/rsyslogd
[14:11:06] Current hash: b1c259538a8cf04b94c03eb03b86c53b09afcac6
[14:11:06] Stored hash : d8637c4e8344a8cb70ceb44b108b11a3bea68948
[14:11:06] Current inode: 1062266 Stored inode: 1128874
[14:11:06] Current size: 521824 Stored size: 522432
[14:11:06] Current file modification time: 1412265669 (02-Okt-2014 18:01:09)
[14:11:06] Stored file modification time : 1386162987 (04-Dez-2013 14:16:27)

/usr/bin/file [ Warning ]
[14:11:08] Warning: The file properties have changed:
[14:11:08] File: /usr/bin/file
[14:11:08] Current inode: 1048873 Stored inode: 1048913
[14:11:08] Current file modification time: 1409364321 (30-Aug-2014 04:05:21)
[14:11:08] Stored file modification time : 1405013931 (10-Jul-2014 19:38:51)

/usr/bin/ldd [ Warning ]
[14:11:09] Warning: The file properties have changed:
[14:11:09] File: /usr/bin/ldd
[14:11:09] Current hash: b71c0aa85b5f67338350c8a457fe1b0b11c309f2
[14:11:10] Stored hash : 096f5cf39d80bebb4b8f287d769a519439edd750
[14:11:10] Current inode: 1053347 Stored inode: 1056600
[14:11:10] Current file modification time: 1417462941 (01-Dez-2014 20:42:21)
[14:11:10] Stored file modification time : 1406571577 (28-Jul-2014 20:19:37)
[14:11:10] Info: Found file ´/usr/bin/ldd´: it is whitelisted for the ´script replacement´ check.

/usr/bin/logger [ Warning ]
[14:11:10] Warning: The file properties have changed:
[14:11:10] File: /usr/bin/logger
[14:11:10] Current inode: 1052853 Stored inode: 1048864
[14:11:10] Current file modification time: 1415301606 (06-Nov-2014 20:20:06)
[14:11:10] Stored file modification time : 1401828884 (03-Jun-2014 22:54:44)

/usr/bin/wget [ Warning ]
[14:11:14] Warning: The file properties have changed:
[14:11:14] File: /usr/bin/wget
[14:11:14] Current hash: dd4d248060ee83615923a2f6ce2ba7bd6a7a0b70
[14:11:14] Stored hash : f16785dc9538dbfdf6ffe8e49ad6d9bdeccf9755
[14:11:14] Current inode: 1050139 Stored inode: 1049333
[14:11:14] Current file modification time: 1414679893 (30-Okt-2014 15:38:13)
[14:11:14] Stored file modification time : 1391796130 (07-Feb-2014 19:02:10)
[14:11:14] /usr/bin/whatis [ Warning ]
[14:11:14] Warning: The file properties have changed: 1
[14:11:14] File: /usr/bin/whatis
[14:11:14] Current inode: 1062131 Stored inode: 1049168
[14:11:14] Current file modification time: 1411490632 (23-Sep-2014 18:43:52)
[14:11:14] Stored file modification time : 1397127568 (10-Apr-2014 12:59:28)
[14:11:15] /usr/bin/whereis [ Warning ]
[14:11:15] Warning: The file properties have changed:
[14:11:15] File: /usr/bin/whereis
[14:11:15] Current inode: 1053660 Stored inode: 1061512
[14:11:15] Current file modification time: 1415301606 (06-Nov-2014 20:20:06)
[14:11:15] Stored file modification time : 1401828884 (03-Jun-2014 22:54:44)

/usr/bin/unhide.rb [ Warning ]
[14:11:15] Warning: The command ´/usr/bin/unhide.rb´ has been replaced by a script:
/usr/bin/unhide.rb: Ruby script, ASCII text

/sbin/fsck [ Warning ]
[14:11:16] Warning: The file properties have changed:
[14:11:16] File: /sbin/fsck
[14:11:16] Current inode: 787128 Stored inode: 834790
[14:11:16] Current file modification time: 1415301606 (06-Nov-2014 20:20:06)
[14:11:16] Stored file modification time : 1401828884 (03-Jun-2014 22:54:44

/bin/bash [ Warning ]
[14:11:19] Warning: The file properties have changed:
[14:11:19] File: /bin/bash
[14:11:19] Current hash: 8e3aa19fdc42e87659746f6dc8ea3af74ab30362
[14:11:19] Stored hash : 966672a53bec6b0e43137e187d9bc5dce05d8443
[14:11:19] Current inode: 1048596 Stored inode: 1063146
[14:11:19] Current size: 1021112 Stored size: 1017016
[14:11:19] Current file modification time: 1412709732 (07-Okt-2014 21:22:12)
[14:11:19] Stored file modification time : 1398292992 (24-Apr-2014 00:43:12)

/bin/dmesg [ Warning ]
[14:11:19] Warning: The file properties have changed:
[14:11:19] File: /bin/dmesg
[14:11:19] Current inode: 1053681 Stored inode: 1051634
[14:11:19] Current file modification time: 1415301606 (06-Nov-2014 20:20:06)
[14:11:20] Stored file modification time : 1401828884 (03-Jun-2014 22:54:44)

Warning: The file properties have changed:
[14:11:21] File: /bin/more
[14:11:21] Current inode: 1053680 Stored inode: 1052853
[14:11:21] Current file modification time: 1415301606 (06-Nov-2014 20:20:06)
[14:11:21] Stored file modification time : 1401828884 (03-Jun-2014 22:54:44)
[14:11:21] /bin/mount [ Warning ]
[14:11:21] Warning: The file properties have changed:
[14:11:21] File: /bin/mount
[14:11:22] Current inode: 1053613 Stored inode: 1050577 2
[14:11:22] Current file modification time: 1415301606 (06-Nov-2014 20:20:06)
[14:11:22] Stored file modification time : 1401828884 (03-Jun-2014 22:54:44)

System checks summary
[14:13:11] =====================

[14:13:11] File properties checks…
[14:13:11] Files checked: 137
[14:13:11] Suspect files: 13
[14:13:11]
[14:13:11] Rootkit checks…
[14:13:11] Rootkits checked : 292
[14:13:11] Possible rootkits: 0
[14:13:11]
[14:13:11] Applications checks…
[14:13:11] All checks skipped

2. Ergebnis mit chkrootkit:

Searching for Suckit rootkit:

Warning: /sbin/init infeckted.

Beantwortete Frage von dirkkleemann Februar 4, 2015