#1  
Old 8th April 2009, 20:58
Tripple Tripple is offline
Senior Member
 
Join Date: Jul 2007
Posts: 114
Thanks: 7
Thanked 3 Times in 3 Posts
Default rkhunter

My fresh ISPConfig 3.0.1.1 installation keeps warning me with rkhunter.

I receive a simple mail with this line:
Please inspect this machine, because it can be infected

No logfile to inspect so I ran rkhunter again:
# rkhunter -c --createlogfile

2 warnings in the logfile:
WARNING, found: /usr/share/man/man1/..1.gz (gzip compressed data, from Unix, max compression) /dev/.udev (directory)
Warning: root login possible. Change for your safety the 'PermitRootLogin'

I can fix the last warning but what about the first one?
Reply With Quote
Sponsored Links
  #2  
Old 9th April 2009, 09:19
till till is online now
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 35,504
Thanks: 813
Thanked 5,266 Times in 4,129 Posts
Default

Never seen the first warning. Did you take a look in the .udev directory?
__________________
Till Brehm
--
Get ISPConfig support and the ISPConfig 3 manual from ispconfig.org.
Reply With Quote
  #3  
Old 9th April 2009, 17:38
Tripple Tripple is offline
Senior Member
 
Join Date: Jul 2007
Posts: 114
Thanks: 7
Thanked 3 Times in 3 Posts
Default

Fixed it like this:
https://bugzilla.redhat.com/show_bug.cgi?id=190248

When I run rkhunter, no more errors.
However, I'm still receiving those mails.
Reply With Quote
  #4  
Old 19th April 2009, 21:35
Tripple Tripple is offline
Senior Member
 
Join Date: Jul 2007
Posts: 114
Thanks: 7
Thanked 3 Times in 3 Posts
Default

I like to start this old topic again because I can't figure out what the problem is.

Every hour at xx:53 there's a mail to root like this:
Subject: [rkhunter] Warnings found for host@domain
Please inspect this machine, because it can be infected

I can't find any cron job that could cause this so the only way to reproduce this is, I guess, with the command #rkhunter -c --createlogfile, but I can't see any errors in the logfile.
Reply With Quote
  #5  
Old 20th April 2009, 12:05
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,735 Times in 2,571 Posts
Default

What's the output of
Code:
ls -la /etc/cron.hourly
?
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #6  
Old 20th April 2009, 17:21
Tripple Tripple is offline
Senior Member
 
Join Date: Jul 2007
Posts: 114
Thanks: 7
Thanked 3 Times in 3 Posts
Default

It's empty:

# ls -la /etc/cron.hourly/
totaal 24
drwxr-xr-x 2 root root 4096 apr 19 21:19 .
drwxr-xr-x 103 root root 12288 apr 20 17:16 ..
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Installation Order? ISPConfig3 Jailkit Backup PC Snort/Ossec/Prelude RKHunter RolluS Installation/Configuration 6 23rd January 2009 22:55
rkhunter Found differences in user groups... stefan Installation/Configuration 2 12th June 2007 23:13
Trouble with Mail Server Jcorrea920 General 5 21st February 2006 20:42


All times are GMT +2. The time now is 12:21.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.