Rkhunter

Ai fui ver como anda a integridade do sistema, em busca vulnerabilidade, de rootkit, backdoor, sniffer e exploit scanner.

apt-get install rkhunter
rkhunter -c

para atualizar as informações rode o comando

rkhunter --propupd

a única falha que ele achou foi o arquivo de configuração do sshd com permissão de acesso via root ;)

Quando dá as mensagens:

Warning: Application 'gpg', version '1.4.9', is out of date, and possibly a security risk.
Warning: Application 'openssl', version '0.9.8g', is out of date, and possibly a security risk.
Warning: Application 'php', version '5.2.6', is out of date, and possibly a security risk.
Warning: Application 'proftpd', version '1.3.1', is out of date, and possibly a security risk.
Warning: Application 'sshd', version '5.1p1', is out of date, and possibly a security risk.

eu acrescentei em /etc/rkhunter.conf

APP_WHITELIST="gpg:1.4.9 openssl:0.9.8g php 5.2.6 proftpd 1.3.1 sshd:5.1p1"

e para o erro em

/dev/shm/network/ifstate: ASCII text

acrescentei

ALLOWDEVFILE=/dev/shm/network/ifstate

instalei o lsb (apt-get install lsm) e começou a aparecer o erro

Warning: The file '/usr/bin/mail' exists on the system, but it is not present in the rkhunter.dat file.
Warning: The file '/usr/bin/rpm' exists on the system, but it is not present in the rkhunter.dat file.
Warning: The file '/usr/bin/bsd-mailx' exists on the system, but it is not present in the rkhunter.dat file.

nas menagens

Warning: Hidden directory found: /dev/.udev
Warning: Hidden directory found: /dev/.initramfs

corrigi assim

ALLOWHIDDENDIR=/dev/.initramfs
ALLOWHIDDENDIR=/dev/.udev

nas na mensagem

SSH configuration option 'PermitRootLogin': yes
Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no

alterei de

ALLOW_SSH_ROOT_USER=no

para

ALLOW_SSH_ROOT_USER=yes