chkrootkit daily report accuses PACKET SNIFFER for /usr/sbin/dhcpd3

[Christian Reis]

Binary package hint: chkrootkit

This seems to be a regression from previous versions. Here's what I am seeing on Lucid:

  ii chkrootkit 0.49-3 rootkit detector

  kiko@anthem:~$ sudo /usr/lib/chkrootkit/ifpromisc
  lo: not promisc and no packet sniffer sockets
  eth2: not promisc and no packet sniffer sockets
  eth1: PACKET SNIFFER(/usr/sbin/dhcpd3[3805])
  eth0: not promisc and no packet sniffer sockets

I think dhcpd3 is safe to run, and based on what I've seen in a debian bug report, this has been fixed before. I just wonder if it's regressed or if this is a new problem in old clothing.

[Marc Deslauriers (mdeslaur)]

Thanks for reporting this.

The README.FALSE-POSITIVES file does document that dhcp will come up as a false positive.

Although chkrootkit does display dhcpd3, the cron.daily job in the chkrootkit package filters it out before sending the report.

What version were you running before that makes this seem like a regression? What Debian bug report did you see that mentioned this being fixed?

[Christian Reis (kiko)]

I was referring to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525370 but now that I see it it's not exactly the same issue.

So I think something is wrong in my cron.daily script, then, because I'm seeing this in my email notifications. Let me check. Okay, so if cron.daily is running its chkrootkit script as I think it should be, then this regexp may be broken:

  # the sed expression replaces the messages about /sbin/dhclient3 /usr/sbin/dhcpd3
  # with a message that is the same whatever order eth0 and eth1 were scanned
  sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient3|/usr/sbin/dhcpd3)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient3|dhcpd3]{PID}\),' \
  -e 's/(! \w+\s+)[ 0-9]{4}[0-9]/\1#####/' $LOG_DIR/log.today.raw > $LOG_DIR/log.today

Could that be the issue?

[Christian Reis (kiko)]

Date: Tue, 6 Jul 2010 06:42:22 -0300
From: Cron Daemon <root@XXX>
To: root@XXX
Subject: Cron <root@anthem> test -x /usr/sbin/anacron || ( cd / && run-parts
        --report /etc/cron.daily )

/etc/cron.daily/chkrootkit:
[...]
eth1: PACKET SNIFFER(/usr/sbin/dhcpd3[3805])
[...]

[Marc Deslauriers (mdeslaur)]

oh, sorry about that...the cron job doesn't filter the report, it just reformats the dhcp warning so it's always the same and the dhcp line doesn't get reported more than once if DIFF_MODE=true in /etc/chkrootkit.conf.

[Chuck Short (zulcss)]

This is fixed in natty.

chuck