Topic: Daily error from rkhunter

[omega]

Hi,

i get every day a email form the server about rkhunter.
This is the message:

/etc/cron.daily/01-rkhunter:

Warning: The SSH and rkhunter configuration options should be the same:
         SSH configuration option 'PermitRootLogin': yes
         Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)


is this normal, or how can i correct this.

[David Harper]

Welcome to the forums

This is a harmless error. If you want to follow the progress made by the developers on removing the bug, see this bug report.

[uniqsys]

Welcome!

Yes this is a harmless error message.  It can be annoying to receive but everyone looks forward to mail everyday and this is a sure one! 

Seriously, to resolve this temporarily you need to match the SSH and rkhunter settings as the notification says.  Since you have set "permit root login" to yes in server-manager, then you need to make rkhunter match that.

To do this, edit "/etc/rkhunter.conf" with your favorite editor such as vi or pico, and look for 'ALLOW_SSH_ROOT_USER=no'. Now change the 'no' to a 'yes' (DON'T change anything else) and save the file.  If you have done it correctly the email will not be sent until you change the SSH setting in server-manager to 'no'.  Both settings must be in sync to avoid the email.

As the bug report suggests,  a template fragment should really be the way to fix this, but this approach will work for now.

This is temporary as the developers are working on a permanent fix.

[omega]

Is it dangerous for my system, to set it to yes?

[Stefano]

Is it dangerous for my system, to set it to yes?

no

Ciao
Stefano

[edform]

This is a harmless error. If you want to follow the progress made by the developers on removing the bug, see this bug report.

I've sat and accepted that this is a harmless inconsistency in configuration until yesterday when I noticed unusual activity on my ADSL router. With no other machine running in the system but my SME 7.4 server, there is a constant level of activity at the ADSL router which was not evident a few days ago. When I look at Top I see processor usage only for Top itself and every few seconds from SSHD - except when a mail event occurs. This activity is constant and at times fairly rapid.

I took a look at the rkhunter log and found this...

[04:02:34] Warning: The SSH and rkhunter configuration options should be the same:
[04:02:34]          SSH configuration option 'PermitRootLogin': yes
[04:02:34]          Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no
[04:02:34]   Checking if SSH protocol v1 is allowed          [ Not allowed ]
[04:02:34]   Checking for running syslog daemon              [ Found ]
[04:02:34]   Checking for syslog configuration file          [ Found ]
[04:02:34] Info: Found syslog configuration file: /etc/syslog.conf
[04:02:34]   Checking if syslog remote logging is allowed    [ Not allowed ]
[04:02:34]
[04:02:34] Performing filesystem checks
[04:02:34] Info: Starting test name 'filesystem'
[04:02:34] Info: SCAN_MODE_DEV set to 'THOROUGH'
[04:02:34]   Checking /dev for suspicious file types         [ None found ]
[04:02:34] Info: Found hidden file '/usr/share/man/man1/..1.gz': it is whitelisted.
[04:02:34]   Checking for hidden files and directories       [ None found ]
[04:02:34]
[04:02:34] Info: Test 'apps' disabled at users request.

Which doesn't tell me much, *BUT* there is a suspicious circumstance in my system which seems too much of a coincidence to ignore. I spent 10 hours or so the day before yesterday with a client's PC hooked to my system with a savage malware trojan infection that was a nightmare to remove because it began by corrupting userinit.exe and the corresponding system call that runs this executable at logon - the machine would simply return to the logon screen a few seconds after each attempt to logon, so I had to find a way to get into the machine in the first place. Once I got in I found the root cause of the problem in a tiny file called jill.exe - Jill is one of the usernames registered on the PC. It could be swept with an AV scanner and not be flagged, but as soon as the system attempted to run it, the AV system flagged up a virus, so it had somehow scattered it's parts around the system and called them all together as a virus when it ran. Since the fundamental purpose of this trojan entity was to hold the door of the firewall open to invite the bad guys in, and it was very successful - I found over 10,000 infected objects - I'm concerned to find that something is poking the internet from my server now, with no obvious hostile activity on the server itself.

I've run a ClamAV scan with no hostiles reported, and as shown above, the Rootkit hunter doesn't seem to show anything either.

Anyone able to suggest what I should do next? I assume I'll get the usual - 'report a bug' - but I have no idea what to report, and I'm greatly inclined to just reload my server from scratch, so the only working test environment isn't going to exist much longer.

Ed Form

[David Harper]

Indeed, I would add this to the existing bug report if you are at all concerned.

But in this instance I would suggest that there is no problem. SME Server's firewall does not prevent any outgoing traffic by default, and it would be unusual for a Windows-based trojan to infect a Linux-based server. IMHO the fact that it has infected files stored on the server and shared to the infected PC via Samba is not really indicative of a trojan executing harmful code on the server itself.

[edform]

Indeed, I would add this to the existing bug report if you are at all concerned.

But in this instance I would suggest that there is no problem. SME Server's firewall does not prevent any outgoing traffic by default, and it would be unusual for a Windows-based trojan to infect a Linux-based server. IMHO the fact that it has infected files stored on the server and shared to the infected PC via Samba is not really indicative of a trojan executing harmful code on the server itself.

Thanks for the reply, David, but I think you've missed my point. The server is the only machine on the system and it is speaking to the internet all the time. No other machine is running, and the only activity on the server seems to be constant bursts of activity by sshd. The infected machine did not get infected on my system, I brought it back to my office from a client's site and this activity on the ADSL link began immediately after the infected machine had been on my system. Before that the ADSL would sit dormant for minutes on end, only waking up when mail events occurred.

Ed Form

[David Harper]

Okay, that sounds more serious, I agree.

[rgmhtt]

I've sat and accepted that this is a harmless inconsistency in configuration until yesterday when I noticed unusual activity on my ADSL router. With no other machine running in the system but my SME 7.4 server, there is a constant level of activity at the ADSL router which was not evident a few days ago. When I look at Top I see processor usage only for Top itself and every few seconds from SSHD - except when a mail event occurs. This activity is constant and at times fairly rapid.

Whenever you allow root login to SSH and there is ANY WAY this system can be reach by outsiders there are two steps to choose from that you REALLY should do:

Set limiting on port 22.  I know how to do this with Shorewall, I have not studied the firewall package on SME to know how to limit connections.

Change the SSH port to something unique to you and DON'T tell ANYONE about it.  Then you do have to open this port on your firewall if you want external access.  Port knockers may find this port but if you choose something above 1024, that is not too likely.

Whenever I build a new linux system one of the first steps I take is to move SSH to my favorite port.  This cuts down on a lot of noise on my networks and a lot of messages on the cron jobs.

BTW, I am island hopping into my SME box from the IETF and was looking on how to 'fix' this rkhunter warning.  I figured to search the forum to see what the collective wisdom on it was before doing a new post.  Every now and then, I get the process right.

[mercyh]

BTW, I am island hopping into my SME box from the IETF and was looking on how to 'fix' this rkhunter warning.

check here:

http://forums.contribs.org/index.php/topic,39594.0.html

Look at post #7 and #12.

This is a bug that should be fixed in later release but this workaround should stop the warning until that happens.

[rgmhtt]

check here:

http://forums.contribs.org/index.php/topic,39594.0.html

Look at post #7 and #12.

This is a bug that should be fixed in later release but this workaround should stop the warning until that happens.

And Replay #2 in this post.

I have made the change and am running cool wrt ssh allow root login and rkhunter...

[mercyh]

Sorry about the repeat. I hope to eventually learn to read the complete thread before posting............