Baslinux mailing list

[3aoo-cvfd AT dea.spamcon.org]

sindi keesan wrote:
>
> I asked The Answer Gang at Linuxgazette why lpr worked 
> only for user and not root and the discussion drifted 
> to security.  They said to only run as user.

Predictable response.

> I was told to check for things hiding in my files:

Also predictable.

> >>>> Do you monitor the logs? 

What logs?  We don't run no logs.

> >>>> Do you run chkrootkit regularly? 

I think a rootkit would find it pretty hard to function
on BL3.  Still, I suppose, anything's possible.

> ./chkrootkit wanted netstat.  

An actual rootkit is going to have the same problem.
Missing binaries, wrong libraries, 2.2 kernel,

> chkrootkit then told me I had six infected files:
> These are all part of busybox 1.1.0 

busybox binaries -- there's another problem for a rootkit.

> compiled statically against uClibc.

And yet another fishhook for the hapless rootkit.  

> Are they really infected 

I doubt it.  But what do I know?  The guys at the 
Answer Gang are the experts, aren't they?

> or is uClibc confusing chkrootkit?

That plus all the other nonstandard and unexpected 
features of the BL3 environment.  

> They are not in the typical locations but are on the 
> path in /busybox110.

A directory called busybox110 ???   How did that get
there?  Did you create it?  

> telnetd and su in this busybox are not infected.

telnetd, oh dear.  Have you been running telnetd while 
online?  If so, that's the perfect entry point for 
installing a rootkit.
 
> You have 13  process hidden for ps command

That doesn't sound good.  If true.

Cheers,
Steven