rkhunter关于/etc/.java /etc/.udev /etc/.initramfs的警告


25

我正在运行Ubuntu 10.04.1 LTS。我正在运行rkhunter来检查rootkit。

rkhunter抱怨以下隐藏的文件和目录。我认为这些文件在我的系统上不是真正的问题,但是如何检查这些文件是否为合法文件?

[07:57:45]   Checking for hidden files and directories       [ Warning ]
[07:57:45] Warning: Hidden directory found: /etc/.java
[07:57:45] Warning: Hidden directory found: /dev/.udev
[07:57:45] Warning: Hidden directory found: /dev/.initramfs

更新资料

原来,这些目录在/etc/rkhunter.conf中特别提到,这表明这是一个常见的rkhunter问题。从rkhunter.conf:

#
# Allow the specified hidden directories.
# One directory per line (use multiple ALLOWHIDDENDIR lines).
#
#ALLOWHIDDENDIR=/etc/.java
#ALLOWHIDDENDIR=/dev/.udev
#ALLOWHIDDENDIR=/dev/.udevdb
#ALLOWHIDDENDIR=/dev/.udev.tdb
#ALLOWHIDDENDIR=/dev/.static
#ALLOWHIDDENDIR=/dev/.initramfs
#ALLOWHIDDENDIR=/dev/.SRC-unix
#ALLOWHIDDENDIR=/dev/.mdadm

Answers:


25

基本上问谷歌,但是那三个都不危险!

/etc/.java由sun-java创建(也可能由OpenJDK创建)/dev/.udev由udevd守护进程创建/dev/.initramfs是我是否正确记得在系统引导过程中将初始ram文件系统安装在何处处理。


2
+1您在chkrootkit中也会得到类似的误报。这是因为rkhunter设置为将隐藏目录视为可疑目录。
理查德·霍洛威
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.