I just finished doing my weekly patches for my F32 workstation. The
sequence (done as root):
1. rkhunter --check
(clean)
2. dnf --refresh upgrade dnf
(nothing to do)
3. dnf upgrade
(no hint of trouble)
4. reboot
(no hint of trouble)
5. rkhunter --check
(trouble!)
I put the rkhunter log file on the google drive; here is the link:
"https://drive.google.com/file/d/1asJQhjhffxOklGivzFLeKV5-gaEVCwYX/view?usp=sharing";.
The file properties checks warning are common after a weekly patching;
ignore those.
The first warning of concern is line #1470:
"[12:33:02] Checking for file '/lib/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/lib64/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/usr/lib/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/usr/lib64/libkeyutils.so.1.9' [
Warning ]".
The next is in line #1602:
"[12:33:08] Warning: Checking for possible rootkit files and directories
[ Warning ]
[12:33:08] Found file '/lib/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/lib64/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/usr/lib/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/usr/lib64/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component".
Both warnings above are in the section
"[12:32:58] Info: Starting test name 'possible_rkt_files'
[12:32:58] Performing check of possible rootkit files and directories",
which starts at line 1388.
Below this section are numerous other warnings about other processes
using suspicious files.
My workstation was clean;
I patched;
now rkhunter says my system is contaminated.
I had nothing else running during the scanning and patching except a
terminal (in which I did the patching), ksysguard, and xeyes.
Are the warnings actual problems or false alarms?
If the problems are real, how do I fix? Re-installing is impractical.
Are there contaminated packages in the repositories?
thanks,
Bill.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
