Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: cirkit on August 10, 2008, 07:43:51 AM

Title: rkhunter glibc error message
Post by: cirkit on August 10, 2008, 07:43:51 AM

I got this rkhunter error last night which i am not able to interpret can any one help me to know what the problem is?

etc/cron.daily/01-rkhunter:

*** glibc detected *** free(): invalid next size (fast): 0x08c93f50 ***
/etc/cron.daily/01-rkhunter: line 2:  3378 Aborted                 /usr/bin/rkhunter --cronjob --update --disable apps,suspscan,system_commands --rwo

Title: Re: rkhunter glibc error message
Post by: cactus on August 10, 2008, 08:41:30 AM

Quote from: cirkit on August 10, 2008, 07:43:51 AM

I got this rkhunter error last night which i am not able to interpret can any one help me to know what the problem is?

etc/cron.daily/01-rkhunter:

*** glibc detected *** free(): invalid next size (fast): 0x08c93f50 ***
/etc/cron.daily/01-rkhunter: line 2:  3378 Aborted                 /usr/bin/rkhunter --cronjob --update --disable apps,suspscan,system_commands --rwo

I suggest you report this in the bugtracker as this seems to be a problem with smeserver core package.

Title: Re: rkhunter glibc error message
Post by: cirkit on August 10, 2008, 09:11:14 AM

I viewed the rkhunter log file. I compared it with the log file of a clone server, the only difference i found in logs were that a lst few scans checks were not listed. Rest all server functions are working fine. I have posted the rkhunter log files for your reference over here. The first file belongs to the server which gave the error and the second file to the clone server http://jst.net.in/logs
I feel the rkhunter stopped half way. Can i re-run rkhunter using cron hourly just to check the result once more, else this task is scheduled once a day and i'll have to wait fir the whole day for it to report me again.
OR can i run rkhunter from root if so please help me with the command, i am new to linux

Title: Re: rkhunter glibc error message
Post by: cactus on August 10, 2008, 09:19:07 AM

Quote from: cirkit on August 10, 2008, 09:11:14 AM

OR can i run rkhunter from root if so please help me with the command, i am new to linux

Code: [Select]

/etc/cron.daily/01-rkhunter

Title: Re: rkhunter glibc error message
Post by: cirkit on August 10, 2008, 09:28:15 AM

thanks, i ran the command and I got the regular result that i receive every day, I think all seems to be normal, I post the result below and can be compared with the message on the second log file linked above, they both are the same

[root@mcp61 ~]# /etc/cron.daily/01-rkhunter
Warning: The following processes are using deleted files:
         Process: (deleted)    PID: 2548    File: /usr/bin/perl.#prelink#
         Process: (deleted)    PID: 3919    File: /usr/bin/perl.#prelink#
Warning: The SSH and rkhunter configuration options should be the same:
         SSH configuration option 'PermitRootLogin': yes
         Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)


One more thing this server is managed remotely via putty, I get the rkhunter message every day at 4:02 am in my mail box, For testing purposes whay happens if i move 01- rkrunter to the cron.hourly directory?

How can i get a mail in my admin mailbox about the results for the command I just issed, It only showed on the putty screen I would like to have it forwarded to my admin mail just as you receive reports everyday for rkhunter freshclam etc.