主页 / ubuntu / 问题

问题[chkrootkit](ubuntu)

Martin Hope
ElToro1966
Asked: 2019-10-05 10:05:13 +0800 CST
  • 1

我刚刚在运行 Ubuntu 18.04 LTS 的笔记本电脑上运行了 chkrootkit，除以下内容外，一切都很清楚：

    Searching for suspicious files and dirs, it may take a while... 
The following suspicious files and directories were found: 
/usr/lib/jvm/.java-1.11.0-openjdk-amd64.jinfo /usr/lib/debug/.build-id 
/usr/lib/rstudio/www/.gitignore 
/usr/lib/rstudio/resources/templates/.gitignore 
/lib/modules/5.0.0-27-generic/vdso/.build-id 
/lib/modules/5.0.0-29-generic/vdso/.build-id
/usr/lib/debug/.build-id 
/lib/modules/5.0.0-27-generic/vdso/.build-id 
/lib/modules/5.0.0-29-generic/vdso/.build-id

这些警告中的任何一个或所有都是误报吗？我对每个警告都进行了相当彻底的搜索，结果却是空的。任何帮助将非常感激。

security 18.04 rstudio chkrootkit
Martin Hope
Asarluhi
Asked: 2017-10-06 07:58:42 +0800 CST
  • 0

我apt-install在新安装的 Ubuntu 服务器 16.04.3 中安装了 chkrootkit。
chkrootkit 首次运行后发现可疑文件和目录：

Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found: 
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/noentry/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd /lib/modules/4.4.0-87-generic/vdso/.build-id /lib/modules/4.4.0-96-generic/vdso/.build-id
/lib/modules/4.4.0-87-generic/vdso/.build-id /lib/modules/4.4.0-96-generic/vdso/.build-id

我注意到三年前 stackexchange 的另一个用户发现了相同的误报并发布了Chkrootkit 发现了很多可疑文件和目录，以及 /sbin/init INFECTED。

在chkrootkit 官方网站的常见问题解答编号 8中声明他们不能将误报列入白名单，因为攻击者可能会使用它，因为他知道 chkrootkit 会忽略某些文件和目录。

您建议如何处理这一长长的文件和目录列表？如何检查它们是否为误报？如果它们是误报，有没有办法将这些文件与其原始内容进行比较（如使用 的包dpkg -V）？

chkrootkit