[Risolto] warnings di Rkhunter

smurf · Messaggio da **smurf** » venerdì 26 dicembre 2008, 21:24

Stamattina ho fatto una scansione di routine con rkhunter e mi ha datao 16 warnings

[10:51:02] Running Rootkit Hunter version 1.3.2 on luca-desktop
[10:51:02]
[10:51:02] Info: Start date is vie dic 26 10:51:02 PET 2008
[10:51:02]

[10:51:27] /bin/login                                        [ Warning ]
[10:51:27] Warning: The file properties have changed:
[10:51:28]          File: /bin/login
[10:51:28]          Current hash: 670dfeceb51ad4d5ad6dafa41cc945e64eedb2a1
[10:51:28]          Stored hash : cd736fab9e0d49b72ad1436623bc1604ce8da5ed
[10:51:28]          Current inode: 393246    Stored inode: 390155
[10:51:28]          Current file modification time: 1228728173
[10:51:28]          Stored file modification time : 1226559432

[10:51:35] /bin/su                                           [ Warning ]
[10:51:35] Warning: The file properties have changed:
[10:51:35]          File: /bin/su
[10:51:35]          Current inode: 393247    Stored inode: 390169
[10:51:35]          Current file modification time: 1228728173
[10:51:35]          Stored file modification time : 1226559432

[10:51:46] /usr/bin/lastlog                                  [ Warning ]
[10:51:47] Warning: The file properties have changed:
[10:51:47]          File: /usr/bin/lastlog
[10:51:47]          Current inode: 216636    Stored inode: 216086
[10:51:47]          Current file modification time: 1228728173
[10:51:47]          Stored file modification time : 1226559432

[10:51:52] /usr/bin/newgrp                                   [ Warning ]
[10:51:52] Warning: The file properties have changed:
[10:51:52]          File: /usr/bin/newgrp
[10:51:52]          Current inode: 216825    Stored inode: 216098
[10:51:52]          Current file modification time: 1228728173
[10:51:52]          Stored file modification time : 1226559432

[10:51:53] /usr/bin/passwd                                   [ Warning ]
[10:51:53] Warning: The file properties have changed:
[10:51:53]          File: /usr/bin/passwd
[10:51:53]          Current inode: 217594    Stored inode: 433916
[10:51:53]          Current file modification time: 1228728171
[10:51:53]          Stored file modification time : 1226559429

[10:51:54] /usr/bin/perl                                     [ Warning ]
[10:51:54] Warning: The file properties have changed:
[10:51:54]          File: /usr/bin/perl
[10:51:54]          Current hash: a96c8d80317b8396d708941f8199446ca54eca80
[10:51:54]          Stored hash : 9c81bf31293a919f378949c44c996c3bbf422916
[10:51:54]          Current inode: 213076    Stored inode: 212353
[10:51:54]          Current file modification time: 1230001795
[10:51:54]          Stored file modification time : 1216891131

[10:52:20] /usr/sbin/groupadd                                [ Warning ]
[10:52:20] Warning: The file properties have changed:
[10:52:20]          File: /usr/sbin/groupadd
[10:52:21]          Current inode: 217598    Stored inode: 468044
[10:52:21]          Current file modification time: 1228728171
[10:52:21]          Stored file modification time : 1226559429

[10:52:21] /usr/sbin/groupdel                                [ Warning ]
[10:52:21] Warning: The file properties have changed:
[10:52:21]          File: /usr/sbin/groupdel
[10:52:21]          Current inode: 217599    Stored inode: 468045
[10:52:21]          Current file modification time: 1228728171
[10:52:22]          Stored file modification time : 1226559429

[10:52:22] /usr/sbin/groupmod                                [ Warning ]
[10:52:22] Warning: The file properties have changed:
[10:52:22]          File: /usr/sbin/groupmod
[10:52:22]          Current inode: 217600    Stored inode: 468047
[10:52:22]          Current file modification time: 1228728171
[10:52:22]          Stored file modification time : 1226559429

[10:52:23] /usr/sbin/grpck                                   [ Warning ]
[10:52:23] Warning: The file properties have changed:
[10:52:23]          File: /usr/sbin/grpck
[10:52:23]          Current inode: 217601    Stored inode: 468049
[10:52:23]          Current file modification time: 1228728171
[10:52:23]          Stored file modification time : 1226559429

[10:52:24] /usr/sbin/nologin                                 [ Warning ]
[10:52:25] Warning: The file properties have changed:
[10:52:25]          File: /usr/sbin/nologin
[10:52:25]          Current inode: 216627    Stored inode: 216082
[10:52:25]          Current file modification time: 1228728173
[10:52:25]          Stored file modification time : 1226559432

[10:52:25] /usr/sbin/pwck                                    [ Warning ]
[10:52:26] Warning: The file properties have changed:
[10:52:26]          File: /usr/sbin/pwck
[10:52:26]          Current inode: 217605    Stored inode: 468057
[10:52:26]          Current file modification time: 1228728171
[10:52:26]          Stored file modification time : 1226559429

[10:52:28] /usr/sbin/useradd                                 [ Warning ]
[10:52:28] Warning: The file properties have changed:
[10:52:28]          File: /usr/sbin/useradd
[10:52:28]          Current inode: 217646    Stored inode: 468063
[10:52:28]          Current file modification time: 1228728171
[10:52:28]          Stored file modification time : 1226559429

[10:52:29] /usr/sbin/userdel                                 [ Warning ]
[10:52:29] Warning: The file properties have changed:
[10:52:29]          File: /usr/sbin/userdel
[10:52:29]          Current inode: 217648    Stored inode: 468065
[10:52:29]          Current file modification time: 1228728171
[10:52:29]          Stored file modification time : 1226559429

[10:52:30] /usr/sbin/usermod                                 [ Warning ]
[10:52:30] Warning: The file properties have changed:
[10:52:30]          File: /usr/sbin/usermod
[10:52:30]          Current inode: 217653    Stored inode: 468068
[10:52:30]          Current file modification time: 1228728171
[10:52:30]          Stored file modification time : 1226559429

[10:52:30] /usr/sbin/vipw                                    [ Warning ]
[10:52:31] Warning: The file properties have changed:
[10:52:31]          File: /usr/sbin/vipw
[10:52:31]          Current inode: 217656    Stored inode: 468070
[10:52:31]          Current file modification time: 1228728171
[10:52:31]          Stored file modification time : 1226559429

ovviamente ho stralciato tutto il resto.

I files che mi mette in evidenza riportano tutti la data di modificazione del 08/12/2008, a parte uno (usr/bin/perl) che riporta la data di modificazione del 22/12/2008.

Credo che ció che mi riporta questo log é il prodotto di aggiornamenti di sicurezza, ma non sono riuscito a trovare il modo di confermarlo.

Qualcuno mi puó dare una mano?

Guiodic

se gli aggiornamenti li hai fatti tramite synaptic oppure il gestore aggiornamenti, basta che leggi la cronologia da synaptic.

smurf · Messaggio da **smurf** » venerdì 26 dicembre 2008, 21:52

immaginavo che ci fosse una cronologia di Synaptic ma non ero riuscito a trovarla, dopo la tua risposta ho cercato di nuovo e finalmente l'ho trovata.
Effettivamente si ci sono stati degli update di login, passwd e perl. Anche se la data dell' aggiornamento é posteriore a quella di modifica evidenziata da rkhunter credo di poter stare tranquillo.

Forum Ubuntu-it