Hi,
On Thursday, 21 January 2021 20:24:14 GMT home user wrote:
I just finished doing my weekly patches for my F32 workstation. The
sequence (done as root):
1. rkhunter --check
(clean)
2. dnf --refresh upgrade dnf
(nothing to do)
3. dnf upgrade
(no hint of trouble)
4. reboot
(no hint of trouble)
5. rkhunter --check
(trouble!)
I put the rkhunter log file on the google drive; here is the link:
"https://drive.google.com/file/d/1asJQhjhffxOklGivzFLeKV5-gaEVCwYX/view?usp=
sharing".
The file properties checks warning are common after a weekly
patching;
ignore those.
The first warning of concern is line #1470:
"[12:33:02] Checking for file '/lib/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/lib64/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/usr/lib/libkeyutils.so.1.9' [ Warning ]
[12:33:02] Checking for file '/usr/lib64/libkeyutils.so.1.9' [
Warning ]".
The next is in line #1602:
"[12:33:08] Warning: Checking for possible rootkit files and directories
[ Warning ]
[12:33:08] Found file '/lib/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/lib64/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/usr/lib/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component
[12:33:08] Found file '/usr/lib64/libkeyutils.so.1.9'. Possible
rootkit: Sniffer component".
<snip>
Are the warnings actual problems or false alarms?
If the problems are real, how do I fix? Re-installing is impractical.
Nothing serious, the bug report can be found here and a new rkhunter is in
updates-testing for F32/33/34 and fixes the warnings..
https://bugzilla.redhat.com/show_bug.cgi?id=1914662
Cheers
Colin
--
Fedora 33