Baslinux mailing list

[sindi keesan <keesan AT sdf.lonestar.org>]

I asked The Answer Gang at Linuxgazette why lpr worked only for user and 
not root and the discussion drifted to security.  They said to only run as 
user.  nmap showed I had no open ports except X so I put 'su user opera' 
in the icewm menu.

But I was told to check for things hiding in my files:

> > > > Do you monitor the logs? Do you run chkrootkit regularly? Do you
> > > > monitor portscans?

I downloaded (about 40K) chkrootkit.tar.gz, unpackaged and typed 'make 
sense' and it produced chkrootkit and some other files.

./chkrootkit wanted netstat.  After a 7 min download (SW7.1) I extracted
it with tar -zxvf tcpicp1.tgz bin/netstat and copied it to /bin.

(I should have done this at the sdf shell account and downloaded only 
netstat).

chkrootkit then told me I had six infected files:

basename dirname echo env ifconfig and traceroute.

These are all part of busybox 1.1.0 compiled statically against uClibc.
Are they really infected (with what?) or is uClibc confusing chkrootkit?
They are not in the typical locations but are on the path in /busybox110.

telnetd and su in this busybox are not infected.


Checking 'date' ... bash
/bin/csh
INFECTED

(I have a /bin/bash but no csh.  Command not found.)

Date is a busybox command.

How do I interpret the above?

Many things it could not find, some it said were not infected.

---------------

Checking 'lkm'...You have 13  process hidden for ps command
chkproc:  Warning:  Possible LKM Trojan installed.

(LKM is loadable kernel module.)

[Online research suggests this is a bug in chkrootkit on some systems.]

no rootkits or worms found...



Chkrootkit uses some commands that are part of busybox: ls ps find cut 
head set uname id strings, and also awk and netstat.  It needs echo, which 
is in my busybox but not BL2 busybox.  I am not set up for compiling in 
BL3.

I cannot check using the BL2 busybox commands instead (no echo).

Sindi