rkhunter complains about files shipped by Ubuntu

[Mikkel Høgh]

Binary package hint: rkhunter

When running rkhunter on my (several) Ubuntu 6.06, I have found at least 4 files/dirs/symlinks shipped by Ubuntu itself that is found to be "suspicious" by rkhunter.

These are:
/lib/modules/2.6.15-27-amd64-generic/volatile/.mounted
/dev/.static
/dev/.udev
/dev/.initramfs

Although it is easy to add these to the the allow-list in /etc/rkhunter.conf, it's annoying to have to do this on all your servers, so I think it would be sensible for Ubuntu to add these to the rkhunter.conf we ship.

[Achim Bohnet (allee)]

I can confirm it. In edgy and feisty, the daily cronjob still always warns about:
Found warnings:
[07:38:24] WARNING, found: /dev/.static (directory) /dev/.udev (directory) /dev/.initramfs (directory) /etc/.java (directory)

[hasan (hassanidin)]

I can confirm this on Feisty as well. I get the following output:

* Filesystem checks
   Checking /dev for suspicious files... [ OK ]
   Scanning for hidden files... [ Warning! ]
---------------
/etc/.pwd.lock /dev/.tmp-11-0
/dev/.static
/dev/.udev
/dev/.initramfs
/dev/.initramfs-tools
---------------
Please inspect: /dev/.tmp-11-0 (block special (11/0)) /dev/.static (directory) /dev/.udev (directory) /dev/.initramfs (directory)

[Press <ENTER> to continue]

[Marco Rodrigues (gothicx)]

Fixed on 1.3.0-1 now in Gutsy...

[Cristóbal M. Palmer (cristobalpalmer)]

From /var/log/rkhunter.log:

[15:42:19] Performing filesystem checks
[15:42:19] Info: Starting test name 'filesystem'
[15:42:19] Info: SCAN_MODE_DEV set to 'THOROUGH'
[15:43:43] Checking /dev for suspicious file types [ None found ]
[15:43:44] Checking for hidden files and directories [ Warning ]
[15:43:44] Warning: Hidden directory found: /dev/.static
[15:43:44] Warning: Hidden directory found: /dev/.udev
[15:43:44] Warning: Hidden directory found: /dev/.initramfs

this is on:

cmpalmer@albert:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=7.10
DISTRIB_CODENAME=gutsy
DISTRIB_DESCRIPTION="Ubuntu 7.10"

also:

cmpalmer@albert:~$ dpkg -l rkhunter|grep ^ii
ii rkhunter 1.3.0-1 rootkit, backdoor, sniffer and exploit scanner

this is out-of-the-box rkhunter with no config changes on my part.

Cheers,
CMP

[Cristóbal M. Palmer (cristobalpalmer)]

Now I feel a bit silly. I see the commented-out lines in the conf file, but I'm wondering why they're commented out and not the default?

Cheers,

[weer (romeo8881)]

I can confirm that on Karmic
[21:44:32] Warning: Hidden directory found: /etc/.java
[21:44:32] Warning: Hidden directory found: /dev/.udev
[21:44:32] Warning: Hidden directory found: /dev/.initramfs
[21:44:32] Warning: Hidden file found: /dev/.blkid.tab: ASCII text
[21:44:38]

[Artem Yakimenko (temik)]

Uncommented the needed lines in rkhunter.conf, but /dec/.blkid.tab is still not present in default config:
Warning: Hidden file found: /dev/.blkid.tab: ASCII text
Warning: Hidden file found: /dev/.blkid.tab.old: ASCII text

Ubuntu Karmic 32bit

[Mark Fraser (launchpad-mfraz)]

This is still a problem in Lucid. Had to uncomment the same lines already mentioned, but also had to add
ALLOWHIDDENFILE=/dev/.blkid.tab*
to stop these warnings.
Warning: Hidden file found: /dev/.blkid.tab: ASCII text
Warning: Hidden file found: /dev/.blkid.tab.old: ASCII text

[Boyd Stephen Smith Jr. (bss03)]

Confirmed on Maverick:
Warning: Hidden file found: /dev/.blkid.tab: ASCII text
Warning: Hidden file found: /dev/.blkid.tab.old: ASCII text

There should be added to the shipped rkhunter.conf as ALLOWHIDDENFILE entries. They don't appear to be owned by any installed package ("dpkg -S" doesn't find them), but I believe they are generated during normal operation of Maverick.

[Roger Binns (ubuntu-rogerbinns)]

/dev/.blkid.tab is still an issue in oneiric.

[Joachim Durchholz (jo-durchholz)]

I confirm that the bug still exists in Oneiric.

[Joachim Durchholz (jo-durchholz)]

I'm adding this to bug #219840, which is still open.

[Rody Heijstek (rody-heijstek)]

I can confirm this bug. Running ubuntu 10.04 LTS.

How to fix, in await of the bugfix/package update:

Add the line

ALLOWHIDDENFILE=/dev/.blkid.tab*

...to /etc/rkhunter.conf.

Afterwards run the command:

rkhunter --propupd

...to update the datafile of rkhunter.

And run:

rkhunter --check --sk --rwo

...to confirm there are no erros (false positives) anymore. The --sk and ---rwo are skip keypresses and report warnings only options, to make life a little easier.