rkhunter und chkrootkit false positives?

Debian macht sich hervorragend als Web- und Mailserver. Schau auch in den " Tipps und Tricks"-Bereich.
Antworten
debiator
Beiträge: 267
Registriert: 04.10.2015 20:25:21

rkhunter und chkrootkit false positives?

Beitrag von debiator » 11.11.2024 00:42:05

Hi,

hier mal die Meldung von chkrootkit, die für mich nach false positive aussieht. Aber vielleicht kann jemand Genaueres dazu sagen:

Code: Alles auswählen

/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/noentry/.htaccess
/usr/lib/ruby/vendor_ruby/rubygems/ssl_certs/.document
/usr/lib/ruby/vendor_ruby/rubygems/tsort/.document
/usr/lib/ruby/vendor_ruby/rubygems/optparse/.document
/usr/lib/ruby/gems/3.1.0/gems/typeprof-0.21.2/vscode/.gitignore
/usr/lib/ruby/gems/3.1.0/gems/typeprof-0.21.2/vscode/.vscode
/usr/lib/ruby/gems/3.1.0/gems/typeprof-0.21.2/vscode/.vscodeignore
Und hier die vom rkhunter, bei der ich davon ausgehe, dass es Update-Prozesse waren, also habe ich APT_AUTOGEN auf true gesetzt und PKGMGR=DPKG ist drin.

Code: Alles auswählen

Warning: The file properties have changed:
         File: /usr/bin/curl
         Current inode: 136496    Stored inode: 152154
         Current file modification time: 1726601364 (17-Sep-2024 21:29:24)
         Stored file modification time : 1723914389 (17-Aug-2024 19:06:29)
Warning: The file properties have changed:
         File: /usr/bin/dmesg
         Current inode: 132306    Stored inode: 140379
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/ipcs
         Current inode: 147633    Stored inode: 140429
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/last
         Current inode: 147639    Stored inode: 140430
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/ldd
         Current inode: 147710    Stored inode: 132953
         Current file modification time: 1730464940 (01-Nov-2024 13:42:20)
         Stored file modification time : 1723713046 (15-Aug-2024 11:10:46)
Warning: The file properties have changed:
         File: /usr/bin/logger
         Current inode: 135797    Stored inode: 132583
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/more
         Current inode: 132316    Stored inode: 140382
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/mount
         Current inode: 132320    Stored inode: 132390
         Current file modification time: 1729256162 (18-Okt-2024 14:56:03)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/ping
         Current hash: 79c87c89129d55fcf2daf29ba1f38eb8d1c57a2bc8ac67a948f10e15dd9c6862
         Stored hash : 76960228e6d2c5ec479e30e8e04171acfb5e54b1f337e5f583ef0a877e87c154
         Current inode: 138048    Stored inode: 138853
         Current file modification time: 1727197236 (24-Sep-2024 19:00:36)
         Stored file modification time : 1669534196 (27-Nov-2022 08:29:56)
Warning: The file properties have changed:
         File: /usr/bin/su
         Current inode: 132318    Stored inode: 140384
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/whereis
         Current inode: 147670    Stored inode: 140454
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/bin/systemd
         Current hash: c42c22231ad5db51f706c3f0743ed0794e532813fb0ad33656b5f175edff2927
         Stored hash : dc984fc0bb18369a407f6a389b721cf62ee8c0eb8874ba721246412b5cde2711
         Current inode: 171809    Stored inode: 148902
         Current file modification time: 1728582053 (10-Okt-2024 19:40:53)
         Stored file modification time : 1724607339 (25-Aug-2024 19:35:39)
Warning: The file properties have changed:
         File: /usr/bin/systemctl
         Current hash: dbca9b78d253c5738ec053aa99d19c0366972029dde588778bbd1d55a08d1ec7
         Stored hash : a0c3be725cd8ada98d7d520702bc1856f5e9e743df2be9faff4a1778493aae67
         Current inode: 133448    Stored inode: 134084
         Current file modification time: 1728582053 (10-Okt-2024 19:40:53)
         Stored file modification time : 1724607339 (25-Aug-2024 19:35:39)
Warning: The file properties have changed:
         File: /usr/sbin/fsck
         Current inode: 132729    Stored inode: 140400
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/sbin/init
         Current hash: c42c22231ad5db51f706c3f0743ed0794e532813fb0ad33656b5f175edff2927
         Stored hash : dc984fc0bb18369a407f6a389b721cf62ee8c0eb8874ba721246412b5cde2711
         Current inode: 136541    Stored inode: 133446
         Current file modification time: 1728582053 (10-Okt-2024 19:40:53)
         Stored file modification time : 1724607339 (25-Aug-2024 19:35:39)
Warning: The file properties have changed:
         File: /usr/sbin/runlevel
         Current hash: dbca9b78d253c5738ec053aa99d19c0366972029dde588778bbd1d55a08d1ec7
         Stored hash : a0c3be725cd8ada98d7d520702bc1856f5e9e743df2be9faff4a1778493aae67
         Current inode: 136547    Stored inode: 133453
         Current file modification time: 1728582053 (10-Okt-2024 19:40:53)
         Stored file modification time : 1724607339 (25-Aug-2024 19:35:39)
Warning: The file properties have changed:
         File: /usr/sbin/sulogin
         Current inode: 136540    Stored inode: 140413
         Current file modification time: 1729256162 (18-Okt-2024 14:56:02)
         Stored file modification time : 1711619532 (28-Mär-2024 10:52:12)
Warning: The file properties have changed:
         File: /usr/lib/systemd/systemd
         Current hash: c42c22231ad5db51f706c3f0743ed0794e532813fb0ad33656b5f175edff2927
         Stored hash : dc984fc0bb18369a407f6a389b721cf62ee8c0eb8874ba721246412b5cde2711
         Current inode: 136770    Stored inode: 135776
         Current file modification time: 1728582053 (10-Okt-2024 19:40:53)
         Stored file modification time : 1724607339 (25-Aug-2024 19:35:39)
Grüße
debiator

Antworten