问题[rkhunter](server)

我有一个 CentOs 7.6 并在 rkhunter 上运行了很长时间。在我所有的操作系​​统更新之后，我运行rkhunter --update --propupd但它最近失败了。

[ Rootkit Hunter version 1.4.6 ]
File updated: searched for 175 files, found 133

Checking rkhunter data files...
  Checking file mirrors.dat                                  [ Update failed ]
  Checking file programs_bad.dat                             [ Update failed ]
  Checking file backdoorports.dat                            [ Update failed ]
  Checking file suspscan.dat                                 [ Update failed ]
  Checking file i18n versions                                [ Update failed ]

Please check the log file (/var/log/rkhunter/rkhunter.log)

[15:21:15] Running Rootkit Hunter version 1.4.6 on stadler-jonas
[15:21:15]
[15:21:15] Info: Start date is Mon 29 Mar 15:21:15 CEST 2021
[15:21:15]
[15:21:15] Checking configuration file and command-line options...
[15:21:15] Info: Detected operating system is 'Linux'
[15:21:15] Info: Found O/S name: CentOS Linux release 7.9.2009 (Core)
[15:21:16] Info: Command line is /bin/rkhunter --update --propupd
[15:21:16] Info: Environment shell is /bin/zsh; rkhunter is using bash
[15:21:16] Info: Using configuration file '/etc/rkhunter.conf'
[15:21:16] Info: Installation directory is '/usr'
[15:21:16] Info: Using language 'en'
[15:21:16] Info: Using '/var/lib/rkhunter/db' as the database directory
[15:21:16] Info: Using '/usr/share/rkhunter/scripts' as the support script directory
[15:21:16] Info: Using '/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin /usr/libexec /usr/local/libexec' as the command directories
[15:21:16] Info: Using '/var/lib/rkhunter' as the temporary directory
[15:21:16] Info: X will be automatically detected
[15:21:16] Info: Found the 'basename' command: /bin/basename
[15:21:16] Info: Found the 'diff' command: /bin/diff
[15:21:16] Info: Found the 'dirname' command: /bin/dirname
[15:21:16] Info: Found the 'file' command: /bin/file
[15:21:16] Info: Found the 'find' command: /bin/find
[15:21:16] Info: Found the 'ifconfig' command: /sbin/ifconfig
[15:21:16] Info: Found the 'ip' command: /sbin/ip
[15:21:16] Info: Found the 'ipcs' command: /bin/ipcs
[15:21:16] Info: Found the 'ldd' command: /bin/ldd
[15:21:16] Info: Found the 'lsattr' command: /bin/lsattr
[15:21:16] Info: Found the 'lsmod' command: /sbin/lsmod
[15:21:16] Info: Found the 'lsof' command: /sbin/lsof
[15:21:16] Info: Found the 'mktemp' command: /bin/mktemp
[15:21:16] Info: Found the 'netstat' command: /bin/netstat
[15:21:16] Info: Found the 'numfmt' command: /bin/numfmt
[15:21:16] Info: Found the 'perl' command: /bin/perl
[15:21:16] Info: Found the 'pgrep' command: /bin/pgrep
[15:21:16] Info: Found the 'ps' command: /bin/ps
[15:21:16] Info: Found the 'pwd' command: /bin/pwd
[15:21:16] Info: Found the 'readlink' command: /bin/readlink
[15:21:16] Info: Found the 'stat' command: /bin/stat
[15:21:16] Info: Found the 'strings' command: /bin/strings
[15:21:16] Info: Found the 'wget' command: /bin/wget
[15:21:16] Info: System is not using prelinking
[15:21:16] Info: Using the '/bin/sha256sum' command for the file hash checks
[15:21:16] Info: Stored hash values used hash function '/bin/sha256sum'
[15:21:16] Info: Stored hash values used package manager 'RPM'
[15:21:17] Info: The hash function field index is set to 1
[15:21:17] Info: Using package manager 'RPM' to update the file hash values
[15:21:17] Info: Found the 'rpm' command: /bin/rpm
[15:21:17] Info: Using package manager 'RPM' for file property checks
[15:21:17] Info: Found the 'rpm' command: /bin/rpm
[15:21:17] Info: Current file attributes will be stored
[15:21:17] Info: The mirrors file will be rotated
[15:21:17] Info: Both local and remote mirrors will be used
[15:21:17] Info: The mirrors file will be updated
[15:21:17] Info: Logging to log file: /var/log/rkhunter/rkhunter.log
[15:21:17] Info: Current logging will be appended to the log file
[15:21:17] Info: Locking is not being used
[15:21:17]
[15:21:17] Info: Starting file properties data update...
[15:21:17] Info: Created temporary file '/var/lib/rkhunter/rkhunter.dat.kQfKgSvfuC'
[15:21:17] Collecting O/S info...
[15:21:17] Info: Found system architecture: x86_64
[15:21:17] Info: Found release file: /etc/system-release
[15:21:17] Info: Found O/S name: CentOS Linux release 7.9.2009 (Core)
[15:21:17] Getting file properties...
[15:21:52] Info: Found 35 files in /usr/sbin
[15:21:52] Info: Found 97 files in /usr/bin
[15:21:52] Info: Found 1 files in /usr/lib/systemd
[15:21:52] Info: File updated: searched for 175 files, found 133
[15:21:52] Info: New 'rkhunter.dat' file installed in '/var/lib/rkhunter/db'
[15:21:52]
[15:21:52] Checking rkhunter data files...
[15:21:52] Info: Created temporary file '/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv'
[15:21:52] Info: Created temporary file '/var/lib/rkhunter/mirrors.dat.wwO4z9hT3K'
[15:21:52] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[15:21:52] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/mirrors.dat 2>/dev/null'
[15:21:53] Info: Download failed - 1 mirror(s) left.
[15:21:53] Info: Created temporary file '/var/lib/rkhunter/mirrors.dat.sknQKrCqq0'
[15:21:53] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[15:21:53] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/mirrors.dat 2>/dev/null'
[15:21:54] Warning: Download of 'mirrors.dat' failed: Unable to determine the latest version number.
[15:21:54] Checking file mirrors.dat                         [ Update failed ]
[15:21:54] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/programs_bad.dat 2>/dev/null'
[15:21:56] Info: Download failed - 1 mirror(s) left.
[15:21:56] Info: Created temporary file '/var/lib/rkhunter/mirrors.dat.NmhUHcrnHM'
[15:21:56] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[15:21:56] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/programs_bad.dat 2>/dev/null'
[15:21:57] Warning: Download of 'programs_bad.dat' failed: Unable to determine the latest version number.
[15:21:57] Checking file programs_bad.dat                    [ Update failed ]
[15:21:57] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/backdoorports.dat 2>/dev/null'
[15:21:58] Info: Download failed - 1 mirror(s) left.
[15:21:58] Info: Created temporary file '/var/lib/rkhunter/mirrors.dat.3ROpkzWzsB'
[15:21:58] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[15:21:58] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/backdoorports.dat 2>/dev/null'
[15:21:59] Warning: Download of 'backdoorports.dat' failed: Unable to determine the latest version number.
[15:21:59] Checking file backdoorports.dat                   [ Update failed ]
[15:21:59] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/suspscan.dat 2>/dev/null'
[15:22:00] Info: Download failed - 1 mirror(s) left.
[15:22:00] Info: Created temporary file '/var/lib/rkhunter/mirrors.dat.h8e1l69V8g'
[15:22:01] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[15:22:01] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/suspscan.dat 2>/dev/null'
[15:22:02] Warning: Download of 'suspscan.dat' failed: Unable to determine the latest version number.
[15:22:02] Checking file suspscan.dat                        [ Update failed ]
[15:22:02] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/i18n/1.4.6/i18n.ver 2>/dev/null'
[15:22:03] Info: Download failed - 1 mirror(s) left.
[15:22:03] Info: Created temporary file '/var/lib/rkhunter/mirrors.dat.qXcc7W49IK'
[15:22:03] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[15:22:03] Info: Executing download command '/bin/wget  -q -O "/var/lib/rkhunter/rkhunter.upd.6SWKSwOOqv" https://rkhunter.sourceforge.io/i18n/1.4.6/i18n.ver 2>/dev/null'
[15:22:04] Checking file i18n versions                       [ Update failed ]
[15:22:04] Warning: Download of 'i18n.ver' failed: Unable to determine the latest version number.
[15:22:04]
[15:22:04] Info: End date is Mon 29 Mar 15:22:04 CEST 2021

当我尝试在浏览器 ( http://rkhunter.sourceforge.net/mirrors.dat ) 中打开其中一个 .dat 文件时，我得到以下信息：

An error has been encountered in accessing this page.

1. Server: rkhunter.sourceforge.net
2. URL path: /mirrors.dat
3. Error notes: NONE
4. Error type: 404
5. Request method: GET
6. Request query string: NONE
7. Time: 2021-03-29 13:22:53 UTC (1617024173)

Reporting this problem: The problem you have encountered is with a project web site hosted by SourceForge.net. This issue should be reported to the SourceForge.net-hosted project (not to SourceForge.net).

If this is a severe or recurring/persistent problem, please do one of the following, and provide the error text (numbered 1 through 7, above):

Contact the project via their designated support resources.
Contact the project administrators of this project via email (see the upper right-hand corner of the Project Summary page for their usernames) at user-name@users.sourceforge.net
If you are a maintainer of this web content, please refer to the Site Documentation regarding web services for further assistance.

NOTE: As of 2008-10-23 directory index display has been disabled by default. This option may be re-enabled by the project by placing a file with the name ".htaccess" with this line:

Options +Indexes

我用谷歌搜索了很多，但找不到有用的东西。

所以出现了这种情况，这很烦人，因为它在每次 rkhunter 检查某些服务器时都会发送带有警告的电子邮件。

基本上，错误是这样的：

警告：在 /dev 中发现可疑文件类型：
         /dev/null : ASCII 文本
    

我不知道这是怎么发生的，因为这是一个特殊字符文件：

# /usr/bin/文件 /dev/null
/dev/null：特殊字符

我已经尝试通过在 rkhunter.conf 中尝试这些行来消除此警告：

EXISTWHITELIST=/dev/null
ALLOWHIDDENFILE=/dev/null
ALLOWPROCDELFILE=/dev/null
ALLOWPROCDELFILE=/dev/null
ALLOWDEVFILE=/dev/null

然而，它仍然没有摆脱这个警告。

还发现了这个错误： https ://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866373

它是从 2017 和 1.4.2-6 版本回来的，我收到 1.4.6 的确切警告。

有谁知道如何摆脱这个警告？我有一个想法，从输出中“取消”-grep /dev/null 并将其传递给电子邮件，但这需要相当大的努力，而更好的方法是将其列入 conf 文件中的白名单。

[]# ls -ld /dev/null
crw-rw-rw- 1 根根 1，2019 年 9 月 6 日 3 日 /dev/null

从这个输出中可以看出，它确实是特殊字符。

Ps 这很容易重现： rkhunter --check --report-warnings-only --no-mail-on-warning --enable filesystem

我的问题很简单，我很惊讶以前没有人问过这个问题。

如何将文件或目录添加到 rkhunter 检查？有了它，我可以看到我的目录出现在 'rkhunter --propupd' 命令中

希望有人能帮助我！祝你有美好的一天 ：）

我们在这里运行一个（新的）CentOS 7 系统。为了观察系统免受无效更改/黑客攻击，我们每晚运行 rkhunter。同样在每次（yum）更新之后，我们预先链接所有并运行“rkhunter --propupd”。

这运行良好。但是几天后我们收到以下错误：

[03:55:02] Warning: WARNING! It is the users responsibility to ensure that when the '--propupd' option
           is used, all the files on their system are known to be genuine, and installed from a
           reliable source. The rkhunter '--check' option will compare the current file properties
           against previously stored values, and report if any values differ. However, rkhunter
           cannot determine what has caused the change, that is for the user to do.
...
...
...
[03:55:04] Warning: Checking for prerequisites               [ Warning ]
[03:55:04]          The local host configuration or operating system has changed.
[03:55:05]   /usr/sbin/adduser                               [ Warning ]
[03:55:05] Warning: No inode value found for file '/usr/sbin/adduser' in the 'rkhunter.dat' file.
[03:55:05]   /usr/sbin/chkconfig                             [ Warning ]
[03:55:05] Warning: No inode value found for file '/usr/sbin/chkconfig' in the 'rkhunter.dat' file.
[03:55:05]   /usr/sbin/chroot                                [ Warning ]

我们确信服务器没有被黑客入侵。因为我们检查了一些二进制文件的日期和大小。我们还创建了其中一些文件的校验和。发生 rkhunter 警告后，所有文件都相同且未更改。

但我们想找出 rkhunter 警告的原因是什么......

有任何想法吗？

编辑：

rkhunter 日志文件中还有其他警告：

[03:55:05] Warning: The system has changed to not using prelinking since the last run.
[03:55:05]          Because of the change(s) the file properties checks may give some false-positive results.
[03:55:05]          You may need to re-run rkhunter with the '--propupd' option.

这也是解决方案。请参阅下面我的答案....

我有一个安装了 rkhunter 的 Ubuntu 12.04 系统。目前 rkhunter 每日扫描脚本位于/etc/cron.daily/rkhunter.

每天晚上 7 点 EST 执行 rkhunter 脚本并将以下内容添加到/var/log/rkhunter.log文件中：

Info: Start date is Tue May 22 19:00:29 EDT 2012

但是，这是我的/etc/crontab文件的内容：

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 3   * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

如果我没看错的话，它应该在凌晨 3:25 执行，而不是晚上 7 点。我将它从默认的 6:25 更改为实际执行任务时没有任何变化。

当前输出date与我机器上的本地时间相匹配。sudo service cron restart自从更改 crontab后，我也重新启动了 cron 。

那么，我在这里错过了什么？谢谢！

也许我过于谨慎了，但我最近收到了来自 rkhunter 的以下警告：

Warning: The file properties have changed:
        File: /bin/dmesg
        Current hash: e94b12f49e53695bf5161a445c00b3f97e37e9a8
        Stored hash : 4cc922b102987beea5ec3e10f283b08cfd942658
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/kill
        Current hash: 12f2d4e21474ccdb989c9ee4d4102917e51d8d7b
        Stored hash : 8e14ca5dbdc158a833c2d861bf682e31aae24675
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/logger
        Current hash: 08f2886e3ef1fa5adb34ed8b24477362206f85c6
        Stored hash : c2bf21ac162bc7de5f6c0b787c304707127e5d96
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/login
        Current hash: d05eb12a1184d3babcf3380674293974b8a2dcce
        Stored hash : 4849447380595bbff3aacc1a1ac90e59f7289ca6
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/more
        Current hash: e2bad443495de0c23be2f87f836f80eafa3ba330
        Stored hash : afb55b42873a210a5cec07baa106faa3829cae41
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/mount
        Current hash: cfda891d89dc57c94327bd62845f8ef13c42ff54
        Stored hash : 32d8659bad80b43acc4e437510a88491c9c53294
        Current file modification time: 1263983789 (20-Jan-2010 05:36:29)
        Stored file modification time : 1252007547 (03-Sep-2009 15:52:27)
Warning: The file properties have changed:
        File: /usr/bin/kill
        Current hash: 12f2d4e21474ccdb989c9ee4d4102917e51d8d7b
        Stored hash : 8e14ca5dbdc158a833c2d861bf682e31aae24675
        Current file modification time: 1264059189 (21-Jan-2010 02:33:09)
        Stored file modification time : 1256283752 (23-Oct-2009 03:42:32)
Warning: The file properties have changed:
        File: /usr/bin/logger
        Current hash: 08f2886e3ef1fa5adb34ed8b24477362206f85c6
        Stored hash : c2bf21ac162bc7de5f6c0b787c304707127e5d96
        Current file modification time: 1264059189 (21-Jan-2010 02:33:09)
        Stored file modification time : 1256283752 (23-Oct-2009 03:42:32)
Warning: The file properties have changed:
        File: /usr/bin/whereis
        Current hash: 0d700404e6cfd49bc1ef39465a586706b3b9f008
        Stored hash : 1552446e1285fd3d361e0198149e0a946ee7f28b
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /sbin/nologin
        Current hash: 01b82549a312108b655cca21993d2b24a56f3c7e
        Stored hash : 61255119451e25eb27e6e9a4ca67219564896d4f
        Current file modification time: 1263983792 (20-Jan-2010 05:36:33)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /usr/sbin/vipw
        Current hash: da7bc573ef2c55f1f7e1a7ebb964dbf1187c2702
        Stored hash : dc50bdcb381833d6e8e12cc7af81b37a0b3c4c8e
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)

通常，我检查 yum 日志以查看这些文件最近是否已更新，但我看不到它们有：

Jan 21 02:33:08 Updated: 30:bind-libs-9.3.6-4.P1.el5_4.2.x86_64
Jan 21 02:33:08 Updated: perl-Compress-Raw-Zlib-2.024-1.el5.rf.x86_64
Jan 21 02:33:08 Updated: perl-Compress-Raw-Bzip2-2.024-1.el5.rf.x86_64
Jan 21 02:33:09 Updated: 30:bind-9.3.6-4.P1.el5_4.2.x86_64
Jan 21 02:33:09 Updated: 1:cups-libs-1.3.7-11.el5_4.5.x86_64
Jan 21 02:33:11 Updated: util-linux-2.13-0.52.el5_4.1.x86_64
Jan 21 02:33:11 Updated: gzip-1.3.5-11.el5.centos.1.x86_64
Jan 21 02:33:11 Updated: perl-IO-Compress-2.024-1.el5.rf.noarch
Jan 21 02:33:16 Updated: 30:caching-nameserver-9.3.6-4.P1.el5_4.2.x86_64
Jan 21 02:33:18 Updated: kernel-headers-2.6.18-164.11.1.el5.x86_64
Jan 21 02:33:18 Updated: 1:cups-libs-1.3.7-11.el5_4.5.i386

查看日志文件时是否遗漏了什么？这些软件包之一会导致所有这些软件包的更新吗？也许是 util-linux？

我知道运行 rkhunter --propupd 将重置它扫描的基本文件信息，但我只想确保我不应该首先担心这些结果。被更改的软件包似乎可以用于黑客攻击。

最后运行不会显示任何可疑登录。

我正在尝试在 CentOS 4.8 上通过 yum 安装 rkhunter，但这并没有发生...

Loading "fastestmirror" plugin
Setting up Install Process
Setting up repositories
update                    100% |=========================|  951 B    00:00
rpmforge                  100% |=========================| 1.1 kB    00:00
base                      100% |=========================| 1.1 kB    00:00
addons                    100% |=========================|  951 B    00:00
extras                    100% |=========================| 1.1 kB    00:00
Loading mirror speeds from cached hostfile
Reading repository metadata in from local files
Excluding Packages in global exclude list
Finished
Parsing package install arguments
Error: Package tuple ('rkhunter', 'noarch', None, '1.2.9', '2.rh9.rf') could not be found in packagesack

我知道一些系统管理员基础知识，但是当事情没有按计划进行时，还不足以解决问题，尤其是当 Google 不想放弃货物时！任何帮助都会很棒。