Rkhunter
De MochilaWiki
Revisão de 21h29min de 12 de setembro de 2013 por Banto Palmarino (discussão | contribs)
Ai fui ver como anda a integridade do sistema, em busca vulnerabilidade, de rootkit, backdoor, sniffer e exploit scanner.
# apt-get install rkhunter # rkhunter -c
a única falha que ele achou foi o arquivo de configuração do sshd com permissão de acesso via root ;)
Quando dá as mensagens:
Warning: Application 'gpg', version '1.4.9', is out of date, and possibly a security risk. Warning: Application 'openssl', version '0.9.8g', is out of date, and possibly a security risk. Warning: Application 'php', version '5.2.6', is out of date, and possibly a security risk. Warning: Application 'proftpd', version '1.3.1', is out of date, and possibly a security risk. Warning: Application 'sshd', version '5.1p1', is out of date, and possibly a security risk.
eu acrescentei em /etc/rkhunter.conf
APP_WHITELIST="gpg:1.4.9 openssl:0.9.8g php 5.2.6 proftpd 1.3.1 sshd:5.1p1"
e para o erro em
/dev/shm/network/ifstate: ASCII text
acrescentei
ALLOWDEVFILE=/dev/shm/network/ifstate
instalei o lsb (apt-get install lsm) e começou a aparecer o erro
Warning: The file '/usr/bin/mail' exists on the system, but it is not present in the rkhunter.dat file. Warning: The file '/usr/bin/rpm' exists on the system, but it is not present in the rkhunter.dat file. Warning: The file '/usr/bin/bsd-mailx' exists on the system, but it is not present in the rkhunter.dat file.
nas menagens
Warning: Hidden directory found: /dev/.udev Warning: Hidden directory found: /dev/.initramfs
corrigi assim
ALLOWHIDDENDIR=/dev/.initramfs ALLOWHIDDENDIR=/dev/.udev
nas na mensagem
SSH configuration option 'PermitRootLogin': yes Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no
alterei de
ALLOW_SSH_ROOT_USER=no
para
ALLOW_SSH_ROOT_USER=yes
e nos fóruns indicam rodar o comando
rkhunter --propupd
e resolveu