As one of my Ubuntu root servers was rebooted today without my interaction I checked all of them for root kits with both rkhunter and chkrootkit.
I started with the installation of rkhunter and chkrootkit with apt-get on the command prompt:
|
1 |
seiler@server:/# sudo apt-get install chkrootkit rkhunter |
After that, I ran an update to the rkhunter database,
|
1 |
seiler@server:/# sudo rkhunter --propupd --update |
followed by invoking the deep system scan with rkhunter:
|
1 |
seiler@server:/# sudo rkhunter -c |
Everything seemed fine, as the following output states:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
Checking system commands... Performing 'strings' command checks Checking 'strings' command [fusion_builder_container hundred_percent="yes" overflow="visible"][fusion_builder_row][fusion_builder_column type="1_1" background_position="left top" background_color="" border_size="" border_color="" border_style="solid" spacing="yes" background_image="" background_repeat="no-repeat" padding="" margin_top="0px" margin_bottom="0px" class="" id="" animation_type="" animation_speed="0.3" animation_direction="left" hide_on_mobile="no" center_content="no" min_height="none"][ OK ] Performing 'shared libraries' checks Checking for preloading variables [ None found ] Checking for preloaded libraries [ None found ] Checking LD_LIBRARY_PATH variable [ Not found ] Performing file properties checks [...] [Press <ENTER> to continue] System checks summary ===================== File properties checks... Files checked: 139 Suspect files: 0 Rootkit checks... Rootkits checked : 246 Possible rootkits: 0 Applications checks... All checks skipped The system checks took: 5 minutes and 33 seconds All results have been written to the log file (/var/log/rkhunter.log) |
So next, I started chkrootkit to get a second scan result:
|
1 |
seiler@server:/# sudo chkrootkit |
The output seemed okay, until I recognized the following possible infection in bindshell:
|
1 |
Checking `bindshell'... INFECTED (PORTS: 465) |
So I tried to get more information about this mysterious process running on port 465:
|
1 2 3 |
seiler@server:/# sudo fuser -vn tcp 465 BEN. PID ZUGR. BEFEHL 465/tcp: root 961 F.... master |
The process „master“ doesn´t meant anything to me in the first stage, to I searched in my services:
|
1 2 |
seiler@server:/# sudo grep 465 /etc/services ssmtp 465/tcp smtps # SMTP over SSL |
So in fact, it should be the SMTP server running.
|
1 2 |
seiler@server:/# sudo netstat -antup tcp6 0 0 :::465 :::* LISTEN 961/master |
Netstat is also telling me, that a process „master“ is listening with the PID 961 on that port.
|
1 2 3 4 |
seiler@server:/# sudo lsof -i :465 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME master 961 root 116u IPv4 154909 0t0 TCP *:ssmtp (LISTEN) master 961 root 117u IPv6 154910 0t0 TCP *:ssmtp (LISTEN) |
The process was started as user „root“ and is listening both for IPv4 an IPv6.
|
1 2 3 |
seiler@server:/# sudo ps -F -p 961 UID PID PPID C SZ RSS PSR STIME TTY TIME CMD root 961 1 0 1133 1428 0 14:53 ? 00:00:00 /usr/lib/postfix/master |
And the details to process 961 told me, it is just the postfix master server running there.
So nothing to be curious about.
So be alerted, but not nervous or afraid when a root kit hunter is reporting a supposed malicious process during the check.
It might just be a false positive…
I will nevertheless from now on run these two checks every night through cron.[/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]
Leave A Comment