Your IP : 18.222.161.119
####################################################################
#
# CHANGELOG
#
####################################################################
!! Important notices !!
- Dates in this file are formatted as DD/MM/YYYY (European format).
- The rkhunter configuration file (default /etc/rkhunter.conf) will
not be overwritten when using the rkhunter installer, unless
specifically requested to do so (using the '--overwrite' option).
Be sure you compare your existing configuration file against the
one delivered in this package, in order to optimize the file for
your machine.
--
* 1.4.6 (20/02/2018)
New:
- Added support for Alpine Linux (busybox).
- Added the 'Diamorphine LKM' test.
- Added the ALLOWIPCPID configuration file option. This will allow
specific PIDs to be whitelisted from the shared memory check.
- Added the ALLOWIPCUSER configuration file option. This will allow
specific usernames to be whitelisted from the shared memory check.
- Added the IPC_SEG_SIZE configuration file option. This can be used
to set the minimum shared memory segment size to check. The default
value is 1048576 bytes (1MB).
- Added the SKIP_INODE_CHECK configuration file option. Setting this
option will disable the reporting of any changed inode numbers.
The default is to report inode changes. (This option may be useful
for filesystems such as Btrfs.)
- Added Ebury sshd backdoor test.
- Added a new SSH configuration test to check for various suspicious
configuration options. Currently there is only one check which
relates to the Ebury backdoor.
- Added basic test for Jynx2 rootkit.
- Added Komplex trojan test.
- Added basic test for KeRanger running process.
- Added test for Keydnap backdoor.
- Added basic test for Eleanor backdoor running process.
- Added basic tests for Mokes backdoor.
- Added tests for Proton backdoor.
- Added the SUSPSCAN_WHITELIST configuration file option. This
option can be used to whitelist file pathnames from the
'suspscan' test.
Changes:
- The 'ipc_shared_mem' test will now log the minimum segment size
that will be checked. It will also log the size of any segments
which appear suspicious (that is, larger than the configured
allowed maximum size).
- If verbose logging is disabled, then generally only the test
name and the final result for the test will now be logged.
- Kernel symbol checks will now use the 'System.map' file, if it
exists, and no other kernel symbol file can be found.
Bugfixes:
- For prelinked systems ensure that the default hash function is
SHA1 and not SHA256.
- The result from the 'hidden_procs' test was not being
calculated correctly.
- Checking the O/S version number could be missed in some cases.
- Minor improvement to the *BSD immutable files check.
- The 'OS_VERSION_FILE' configuration option pathname cannot be
a link, but this was not checked.
- Improved checks for the O/S name on Devuan systems.
- Handling of the '/etc/issue' file during O/S detection has now
improved. Escape sequences are either replaced or removed.
- Not all the linux kernel module names were being checked.
- The logging of detached memory segments tried to show the
process pathname. This has now been corrected, and where no
pathname is available, the segment owner and PID will be logged.
- It was possible for the return code to be lost when running the
'ipc_shared_mem' test. This has now been corrected.
- Some configuration options were still not being handled correctly
when specified more than once.
- The 'ipc_shared_mem' test did not correctly handle whitelisting
when a segment pathname was flagged as deleted. This has now
been corrected.
- Commands disabled in the configuration file were being logged
as not found. They are now logged as having been disabled.
- Disabling verbose logging could hide some warning messages.
- The 'shared_libs' test now caters for simple filenames, as well
as pathnames which contain the '$LIB', '$ORIGIN' or '$PLATFORM'
variables.
--
* 1.4.4 (29/06/2017)
New:
- Added the GLOBSTAR configuration file option. This will set the
shells globstar option to allow recursive checks of directories.
By default this option is disabled.
- Added a Japanese translation file.
- Added support for the 'BSDng' package manager option. This can
be used by those *BSD systems which have the 'pkg' command
available (currently later FreeBSD systems).
- The BSD package manager will now try the 'pkg_info' command '-W'
option if the '-F' option fails.
- Added the LOCKDIR configuration option. It is now possible to
specify the directory rkhunter will use to store the lock file
(if USE_LOCKING has been set). The default is unset, and this
will cause rkhunter to look for a directory to use. Details are
in the configuration file.
- Added the ALLOWIPCPROC configuration file option. This can be
used to whitelist suspicious processes using shared memory
segments (found during the 'ipc_shared_mem' check).
Changes:
- The DISABLE_UNHIDE option has been removed from the configuration
file. It is no longer required as disabling the 'hidden_procs' or
'hidden_ports' tests has the same effect.
- The installer now installs directories and executable files with
mode 700, other files are set as mode 600. The man page is left
at mode 644. The documentation directory is mode 755, and the
files within it are mode 644. The 'rkhunter' program itself will
set the mode of copied files to 600 (for example log files, and
the passwd/group files).
- By default the 'apps' test is now disabled in the configuration
file.
- The default hash function for the file properties test, given by
the HASH_CMD option in the configuration file, has now changed
to SHA256. It was previously SHA1, or MD5 if SHA1 was not found.
- Previously the lock file (if locking was used) was just an empty
file. It now contains the PID of the running process.
- The 'system_configs' test name has now been changed into a test
group consisting of the two tests 'system_configs_ssh' and
'system_configs_syslog'. Each test may now be enabled or disabled
individually.
- The 'other_malware' test name has been removed, and replaced by
the 'login_backdoors', 'sniffer_logs', 'tripwire', 'susp_dirs'
and 'ipc_shared_mem' test names. These are now all part of the
'malware' test group.
Bugfixes:
- Ensure that 'lsof' errors are not displayed.
- Ensure that 'ipcs' errors and the locale are handled correctly.
- Correct broken pipe errors in some commands.
- For Solaris users set the 'awk' command very early on so that
option processing works correctly.
- The ALLOWPROCDELFILE option was not handling multiple pathnames
or wildcards correctly. It was also not handling the option
pathnames correctly.
- The SCANROOTKITMODE configuration option was never actually read
as a configuration option.
- The '--config-check'/'-C' option could produce incorrect error
messages in certain circumstances.
- Setting the ALLOW_SSH_PROT_V1 option to '2' could cause warning
messages when SSH protocol 1 was allowed.
- Allow Linux 'grep' to work correctly with binary (i18n) files.
- Multiple UID0_ACCOUNTS and PWDLESS_ACCOUNTS options were not being
handled correctly.
- Uppercase test names were not being handled correctly.
- Changed the 'logger' command tag from 'Rootkit Hunter' to 'rkhunter'
to avoid problems with spaces.
- Ensure that 'fdescfs' filesystems are correctly detected.
- To try and avoid colour escape sequences being logged, both of
the variables CLICOLOR and CLICOLOR_FORCE are unset for *BSD and
SunOS systems.
- The 'startup_malware' and 'possible_rkt_strings' checks will now
check systemd startup scripts if they are located in the
'/etc/systemd/system' directory.
- The 'sockstat' command output on BSD systems can become corrupted
if a username is very long. This is now detected, and processed
correctly.
- The 'shared_libs' test now recognises comments in the preload file.
- The ALLOWPROMISCIF configuration option was not handling multiple
occurrences correctly. This has now been corrected.
- Tighten up the input verification check on the mirror file to
ensure that only URL's are used as a mirror. (CVE-2017-7480)
- The BSD package manager seemed to be needlessly stripping out
parts of package names on NetBSD systems. It no longer does this.
- In certain cases it was possible for certain tests to not display
any output. This has now been corrected.
- The installer did not always add the 'rkhunter.d' directory, if
it existed, to the main configuration file for monitoring.
--
* 1.4.2 (24/02/2014)
New:
- The 'ssh', 'sshd' and 'telnet' commands are now checked as part of
the file properties test.
- It is now possible to include configuration files found in a local
configuration directory. This directory, called 'rkhunter.d', must
be in the same directory as the main configuration file. Only files
ending in '.conf' will be treated as configuration files, all other
files will be ignored. The configuration options found in the files
will be merged with the options found in the main configuration file
and the local configuration file, if present. Both the local
configuration file, and the 'rkhunter.d' configuration files, will
only override a previously specified option if the option can only
be specified once, or, for list options, if the null string is given.
The installer will automatically include any configuration files to
the file properties test.
- A new configuration file option, 'SHOW_SUMMARY_WARNINGS_NUMBER',
can be set so that the summary will display the actual number of
warnings found, rather than the default message which simply states
that one or more warnings were found. If no warnings were found,
then it will be stated that '0' warnings were found.
- The tests to see if 'syslog' is running, and its configuration
file is present, have now been changed. The test has been renamed
to state 'system logging' rather than 'syslog', and will now detect
if 'systemd' logging is being used as well as, or instead of, syslog.
- Two new tests have been added to the 'filesystem' checks. The first
will check if any configured log files are missing, and the second
will check if any configured log files are empty. The second test will
also check if the log files are missing, but only report it if the
first test has not done so. For both tests the results are only shown
if the relevant test has been configured. To enable this there are
also two new configuration file options - MISSING_LOGFILES and
EMPTY_LOGFILES.
- Added the 'UNHIDETCP_OPTS' configuration option. This may be set to
options which are then used by the 'unhide-tcp' command. By default
no options are used.
- Added the SHOW_SUMMARY_TIME configuration option. This can be used
to specify where the summary scan time should be displayed, if at
all. The default (as before) is to display the time both on the
screen and in the log file.
- Added the PORT_PATH_WHITELIST configuration option to be used when
specifying a pathname. Other port whitelisting types use the
PORT_WHITELIST option as before.
- Added Turkish translation files.
- Added System V Shared Memory test for Linux.
- Added ClamAV-compatible signatures for an Apache DSO, pam_unix.so
backdoor, xsyslog, SHV4, SHV5, Kbeast, libncom, Jynx, Turtle,
Glupteba, trojaned OpenSSH daemon, improved libkeyutils.1.9.so and
common sniffer strings. These signatures are highly experimental,
prone to false positives and must be run manually using ClamAV.
Currently no update mechanism is provided and the rkhunter-users
mailing list may or may not provide support for any questions about
these signatures.
Changes:
- The test 'possible_rkts' has been removed because this is exactly
the same as the 'additional_rkts' test.
- To allow for the merging of configuration options from files in the
rkhunter.d directory, the UNHIDE_TESTS, MAIL-ON-WARNING, ENABLE_TESTS
and DISABLE_TESTS options may now be specified more than once.
- It is no longer required that the MAIL-ON-WARNING option exists in
the configuration file.
- Some configuration options, typically lists, can be specified more
than once, and it is now possible to set these options to the null
string ("") so as to delete any previous value. Previously use of the
null string was ignored. Some options may assume a default value if
the option is set to null.
(This change was made so that configuration files in the 'rkhunter.d'
directory, and the local configuration file, can reset an option to
null, and, if required, provide new values simply by specifying the
option once as null and then with a value.)
- The file properties test will now state if the target of a symbolic
link has changed. Previously this would have been detected, but
reported as a change of hash value, inode, file size etc.
- The PORT_WHITELIST configuration option can now only be used to
specify protocol:port pairs or the '*' option. To specify pathnames,
the new PORT_PATH_WHITELIST option must be used.
- Displayed and logged pathnames which contain either space, tab or
control characters are now displayed differently. A space character
will be displayed as '<SP>', a tab as '<TAB>' and a control character
as '?'. This should make pathnames with these characters easier to
see when displayed or logged.
- Detection of the O/S being used now includes looking for the
'/etc/os-release' file.
- In the configuration file the HASH_FUNC option has now changed
name to HASH_CMD. However, the old name will still be recognised.
- Most configuration options which take pathnames are now internally
treated as newline-separated lists. As such, the options can only
have one entry per line, and that entry can contain any character
other than a newline character. (Note: Do not use quotes around the
pathname.) Options which previously used the '%' character to
represent a space, no longer require this.
- The USER_FILEPROP_FILES_DIRS no longer recognises the '!' character
as being special. Any pathnames to be excluded from the file
properties checks should use the new EXCLUDE_USER_FILEPROP_FILES_DIRS
configuration option instead. No '!' is required with that option.
- The 'promisc' test for promiscuous network interfaces now uses
either the 'ifconfig' command or, for Linux systems, the 'ip'
command. Previously the 'ifconfig' command had to be present.
- If either of the APPEND_LOG or COPY_LOG_ON_ERROR configuration
options is set, then this is now logged.
- It is now possible to include filenames containing a colon (:)
character in the file properties tests. The filename can be specified
in the configuration file using the USER_FILEPROP_FILES_DIRS option.
Bugfixes:
- Cater for the latest version of the 'unhide' command.
- Allow the ALLOWDEVFILE option to handle file names containing
forward slashes.
- Improved the process check in the 'packet_cap_apps' test.
- Ensure that the 'rkhunter.conf.local' file, if present, is not a
symbolic link and is readable.
- Improve the test that the root user is running rkhunter.
- The RPM package manager would log (as an info message) if an 'rpm'
command failed, but the user would generally be unaware of this.
Additionally, the relevant file would pass the file properties
test. Now the file is marked as having a missing hash.
- The RPM package manager could produce additional spurious warnings
if a file from a package was deleted, and the '/bin' or '/sbin'
directories were symbolic links (as now occurs with Fedora).
- The 'tripwire', 'ports' and 'running_procs' tests detect possible
rootkits, but these were not being reported in the summary. This
has now been fixed, and those tests will always show a summary.
- The 'filesystem' test did not correctly check a files file type.
Additionally, testing the files size prevented character and block
file types from being detected. As before, empty files are ignored.
The OSX 'file' command can return multiple lines for certain files.
This has now been catered for (generally the output was assumed to
be on one line.)
- Some configuration options were not being processed until late in
the code. Now, all options are processed early in the program. This
means that any error messages will show up much earlier.
- Some configuration options, for specific tests, were being processed
even if the test was disabled. The configuration options are now
only processed if the relevant test is enabled.
- Some configuration options were not being checked fully for errors.
Now, all options are fully checked, and any errors reported.
- If the '--propupd' option was used with the '--enable' option,
it could cause a shell error to appear and some tests not to run
correctly.
- If the '--propupd' option was used in conjunction with the file
properties test, and the hash function was changed, or a package
manager used, then the file properties test would fail stating that
the new and old hash functions, or package managers, were
incompatible. The test now runs as it should using the new hash
function or package manager.
- The pathname of the log file is now logged if the summary is
disabled or a check is not being run. Previously the log file
path only appeared in the check summary.
- Both the '--bindir' command-line option, and the BINDIR configuration
option, are now checked more thoroughly to ensure that the
directories are valid.
- AIX systems do not fully check files when using the 'strings'
command. As such several warnings are produced when the strings
command integrity test is executed. The strings command '-a' option
is now used so that the whole file is checked. This option seems to
be universal so should not be a problem for any other systems.
- When using a hash command of 'NONE' the file properties test would
still report some files as having no hash value. This is now fixed.
- The xinetd check was too simple, and could miss services which were
enabled. The test now also checks for any 'defaults' section, and
checks the found service and 'id' names against the defaults.
--
* 1.4.0 (01/05/2012)
New:
- Added the '--list propfiles' command-line option. This will dump out
the list of filenames that will be searched for when building the file
properties database. By default the list is not shown if just '--list'
is used.
- Added Jynx rootkit check.
- Added Turtle/Turtle2 rootkit check.
- Added KBeast rootkit check.
- The installer now supports the Slackware TXZ package layout option.
Changes:
- Avoid checking exclamation points in ALLOWDEVFILE checks (this was
caught on 01/05/2012 causing a reissue of the 1.4.0 release).
- Allow the ALLOWDEVFILE, ALLOWHIDDENFILE and ALLOWHIDDENDIR options to
use '%' as the space character. (Note: This is a temporary fix).
- The ALLOWPROCDELFILE option can now use wildcards in the file names.
- The '--list perl' command-line option now shows whether the perl
command itself is installed or not.
- The 'shared_libs' test now allows whitelisting of the preloading
environment variables.
- The '-r/--rootdir' command-line options, and the ROOTDIR
configuration option are now deprecated. If they are used then an
error message will be displayed. The options will have no effect,
but rkhunter will continue. The options will be completely removed
at the next release.
- The 'hidden_ports' test will now show if a found port is TCP or UDP.
- It is now possible to whitelist ports in the 'hidden_ports' test
using the PORT_WHITELIST configuration option.
Bugfixes:
- Allow the ALLOWPROCDELFILE option to work again.
- Correct the check of the ProFTPD version number.
- Fix the FreeBSD 'sockstat' command check to ensure that the correct
fields are used.
- Fix for newer version of the 'file' command when reporting scripts.
- Fix the ALLOWHIDDENFILE option to allow hidden symbolic links.
- The 'filesystem' check now handles files and directories with spaces
in their names correctly.
- The 'startup_files' test was displaying file names with spaces in
them incorrectly. Also the test was not checking files which were
in hidden directories.
- Ensure that the ALLOWDEVFILE, ALLOWHIDDENFILE and ALLOWHIDDENDIR
options re-evaluate their whitelisting lists to ensure that any
wildcard entries are the most recent. (A time window previously
existed which meant that the list was processed, but new files
could be created before the test was run. As such they were reported
as false-positive warnings, when they should have been whitelisted.)
- Allow the EXISTWHITELIST option to work with symbolic links.
- The test of whether prelinking is being used or not was sometimes
causing the file properties hash test to be skipped, without the
real reason being stated. Now the hash test will proceed but the
user will still get a warning (because it detects that prelinking was
used and is not now, or vice-versa).
- Rkhunter will now check to see if the 'head' and 'tail' commands
understand the '-n' option. If they do, then it will be used. If they
do not, then the older 'head -1' and 'tail -1' commands will be used.
--
* 1.3.8 (17/11/2010)
New:
- It is now possible to whitelist specific rootkit strings in
specific files using the RTKT_FILE_WHITELIST option. Details
are in the configuration file.
- For those systems on which files generally have the immutable
-bit set, the 'immutable' test can now be reversed (that is,
warnings will be issued for files which do not have the bit
set). The configuration file option IMMUTABLE_SET can be set
to '1' to enable this. By default it is '0'.
- The installer now supports the ppc64 architecture.
- The RTKT_FILE_WHITELIST option can be used to whitelist
reported 'suspicious files' found in the 'running_procs' test.
- Using the EXISTWHITELIST configuration option it is now possible
to whitelist files and directories that might not always be
present on the system. Whitelisted items are, in effect,
whitelisted from 'existence' checks.
- Added a new test to check for hidden network ports being used.
It is called 'hidden_ports'. This test is disabled by default,
and will only run if the 'unhide-tcp' command is present.
- Added support for DragonFly BSD.
- Added Inqtana worm check (variants A, B and C).
- It is now possible to whitelist a combined pathname and port number
with the PORT_WHITELIST configuration option. Details are in the
configuration file.
- Added Togroot rootkit check.
- It is now possible to specify 'SOLARIS' as a package manager for
Solaris systems. It can be used to check several of the file
properties, such as the file permissions, ownership, size and so
on. By default the stored 16-bit hash value is not used, and a hash
value will be calculated, as before, using the configured hash
function. However, if it is wished that the stored hash value is
used, then the USE_SUNSUM configuration option must be enabled.
- The command-line option '--list perl' may be used to see the
installation status of perl modules that may be used by some of
the tests.
- For the file properties test the hash functions 'Whirlpool' and
'Ripemd160' may now be specified. However, only the relevant perl
module will be looked for when using these functions.
- Added Solaris Wanuk backdoor and worm checks.
- The new command-line option '-C' (or '--config-check') can be
used to check the rkhunter configuration files. This will check
most of the options, but only for the tests which would normally
be run (as defined by the enable and disable options). The program
exits once the check has run. See the man page for more details.
- The 'hidden_procs' test will now run the 'unhide.rb' command if it
is present. This is the Ruby version of the original C 'unhide'
program. (The 'unhide' command is also still run if found.)
- Added the DISABLE_UNHIDE configuration option. This allows users
to disable one or other of the 'unhide' or 'unhide.rb' commands
if they are both present on the system. The default is to look
for and run both commands.
- Added OS X Boonana (Koobface.A) trojan check.
Changes:
- Allow the 'unhide' command to be detected on Linux systems.
- Allow most of the whitelisting-type configuration options to
be specified more than once in the configuration file.
- NIS entries are now ignored when checking the password file.
- The use of '--disable all' on the command-line is now allowed
provided that the '--enable' option is also used, and not set
to 'none'. Disabling all the tests in the configuration file
will still give an error.
- If the enabled and disabled test name(s) are the same, then an
error will now be displayed. This only applies to certain
non-grouped test names.
- The check of syslog remote logging no longer considers a
127.x.x.x address as being remote.
- In the configuration file the WEBCMD option has now changed
name to WEB_CMD. However, the old name will still be recognised.
- If the UPDT_ON_OS_CHANGE option is set, and an O/S change has been
detected, a message is now logged stating that an automatic
update will occur. Additionally, the output of the update is no
longer displayed (it looked confusing).
- Removed the automatic exception of TDB database files from the
'filesystem' check. (This seems to have been introduced in version
1.1.3, but we have whitelisting now.)
- The file properties test now handles broken links. These were
previously reported as an error. If there are any broken links,
then the '--propupd' option will report how many have been found.
- The old configuration options LOCAL_RC_PATH and SYSTEM_RC_DIR
have now been removed. They were replaced by STARTUP_PATHS at
version 1.3.6.
- Most of the configuration options which take a list of pathnames,
and which are not set in the provided config file, can now be
specified more than once. They are all now space-separated lists
as well.
- The 'suspicious files' check in the 'running_procs' test now displays
each found file individually. Additionally the warning will include
the command being executed, the PID, the user id, the full pathname
that appears to be suspicious, and the possible rootkit name.
- Reverted a change to the 'os_specific' test so that it will show the
test as being skipped for O/S's which have no specific tests. Without
this if the test was enabled on its own, then nothing at all was
displayed.
- More rigorous testing of the various '.dat' files before each test
which uses them has now been included. If a problem is found, then
a warning is displayed.
- The ALLOW_SSH_ROOT_USER configuration option can no longer be set
to 'yes' if the 'PermitRootLogin' option is not set in the SSH
configuration file. A value of 'unset' must be used.
- The ALLOW_SSH_PROT_V1 configuration option can no longer be set
to '1' if the 'Protocol' option is not set in the SSH configuration
file. A value of '2' must be used. (The use of '1' in this instance
was an undocumented, but allowed setting.)
- The '--enable' and '--disable' command-line options may now be
specified more than once.
- The default behaviour when the command-line option '--disable' is
used has been changed. Rkhunter will now also include the
configuration file option used to disable tests, in order to
determine overall which tests to run. This is more intuitive for the
user. If the previous behaviour of only the '--disable' option being
used to determine which tests to run, then the new '--nocf' option
must also be used.
- The network 'ports' test no longer displays the details of the test
on the screen, but just shows the overall result. This brings the test
format more inline with the other tests. The result of individual
ports being checked is still logged as before.
- The 'sort' and 'uniq' commands are now required to be on the system
in order to run rkhunter.
- Grsecurity-enabled systems may now run the network 'ports' test. If
this causes a problem, then that particular test can be disabled.
- Improved support for OS X a little bit more.
- When using the installer '--show' option, if a directory does not
exist, then it will now state that the directory will be created.
- The 'hidden_procs' test used to run the 'unhide sys' command. Now
it is possible to specify which test names to provide to the 'unhide'
command by using the UNHIDE_TESTS configuration option. It defaults
to 'sys'. This allows for additional tests to be run with 'unhide'
if the user wishes, and caters for newer versions of 'unhide' which
have several new options. Increased the amount of logging of what
rkhunter is doing during the 'hidden_procs' test.
- Both the '--bindir' command-line option and the BINDIR configuration
file option may now be specified more than once. The description of
how these options affect the PATH of rkhunter has been reworded in
both the supplied rkhunter.conf file and the man page.
- The log file permissions and owner/group settings will now be copied
to each new log file, rather than a new log file, with default
permissions, being created each time. This will allow users to
modify the permissions/owner/group of the log file, without them
being lost when a new log file is created. If no log file exists,
then, as before, one will be created with permissions of 600 and
with the owner/group of the root user.
- For OS X users the test of root-equivalent accounts now works
with directory services as well as with the password files.
- The check of the syslog configuration file will now check all
the files found, not just the first one.
Bugfixes:
- Corrected test of ProFTPD version number in apps test.
- Make the apps test version number check case-independent.
- Ensure the promiscuous interface whitelisting is applied to both
parts of the test. Corrected and tidied up the displayed output.
- Correct the test of rkhunter itself being changed to a non-script
file.
- Ensure the suspscan test removes any files it creates. (Again!)
- The --rootdir/ROOTDIR configuration option now works correctly if
specified as '/'. Previously it caused the file properties file
entries to become a bit messed up.
- The file properties immutable test checked the 'lsattr' command
against the rkhunter configuration file. However, if the file was
a symbolic link, then the test failed. Now the test checks 'lsattr'
against several of the rkhunter installed files, looking for a
regular, non-link, file. These include the configuration file, the
rkhunter database files, and the language files.
- The ALLOWDEVFILE whitelisting now allows filenames to contain
colon (:) characters.
- The rootkit summary could list detected rootkit names more than once.
This has now been corrected, each rootkit name will only be
displayed once. The rootkit count will also now only show the number
of unique rootkits found.
- It was possible for part of the summary to be displayed twice. This
has now been corrected so that it only displays once.
- For system startup files (rc files), the rootkit strings check now
ignores comment lines (lines starting with '#'). For Solaris systems,
the 'gstrings' command is used rather than 'strings' if it exists.
- Allow *BSD 'grep' to work correctly with binary (i18n) files.
- Removed the configuration file option use of a comma as an option
separator. Now only spaces and tabs can be used. Use of a comma would
prevent known rootkit files and directories, as well as RCS files, from
being whitelisted correctly.
- When the German language is selected rkhunter will now try to display
messages using the correct encoding.
- The test of rootkit strings in the startup files could display the
wrong string and rootkit. It now displays the correct information.
- The 'filesystem' check now correctly identifies non-standard
directories (e.g. setgid directory), and allows them to be whitelisted.
- The UPDT_ON_OS_CHANGE option was defaulting to 1 rather than 0.
- The result of the libsafe check, a prelink command check, and a prelink
hash function check were not being reported.
- The 'filesystem' check would ignore files with spaces in their name if
the default setting of SCAN_MODE_DEV was used. This has now been
corrected, filenames with spaces in them are checked regardless of the
configuration option setting.
- If the installer is used with the RPM, TGZ or DEB layout options,
and '/' is the build root, then this will now build correctly.
- NetBSD, FreeBSD and OS X would print out an error regarding the 'print'
command. They would also display the locking messages incorrectly. Both
of these have now been corrected.
- The sockstat/netstat output check for *BSD systems gave a spurious
error message because FreeBSD/OpenBSD sockstat did not support the '-n'
option. This has been fixed, but NetBSD systems will still use it.
- The installer option '--layout custom /' now works correctly.
- The SHA256 perl module was not being called correctly.
--
* 1.3.6 (30/11/2009)
New:
- Added ZK rootkit check.
- German translation provided.
- Added the IGNORE_PRELINK_DEP_ERR option to the configuration file. This
option can be used when a persistent prelink dependency error occurs.
Further details of its use are in the configuration file.
- Added CX rootkit check.
- Added the USER_FILEPROP_FILES_DIRS configuration option. This allows
users to add further files and directories to the file properties
check. Details are in the configuration file. The installer program
will automatically add the configuration file pathname to this option.
- Added the EPOCH_DATE_CMD configuration option. In the file properties
test any modification date/times will now be displayed in human-readable
format as well as the number of epoch seconds. This option can be used
to specify the command to use if the 'date' or 'perl' commands cannot
convert epoch seconds.
- Added the COPY_LOG_ON_ERROR configuration option. When set this will
take a copy of the log file if any errors or warnings have occurred.
- Added the WEBCMD configuration option. This allows users to specify
the command used to download data file updates from the Internet.
- It is now possible to put configuration changes into a local config
file. This file, called 'rkhunter.conf.local', must be in the same
directory as the main configuration file. Rkhunter will look for
configuration options in the main config file, and then in the local
config file if it exists. As before, for options allowed only once,
the last one seen is used. For options allowed more than once, all
options from both files will be used.
- Added the SHARED_LIB_WHITELIST configuration option to allow the
whitelisting of preloaded shared libraries.
- Made some minor changes to enable support for SliTaz Linux.
- Added the WARN_ON_OS_CHANGE and UPDT_ON_OS_CHANGE configuration
options. During the file properties check there are some O/S tests
performed to see if the O/S has changed since the last run of
'rkhunter --propupd'. By default if something has changed, then a
warning is shown. If the WARN_ON_OS_CHANGE option is unset, then no
warnings will be shown. If the UPDT_ON_OS_CHANGE option is set, and
the O/S has changed, then rkhunter will automatically update the file
properties file (in effect, it will run 'rkhunter --propupd').
- The installer now has a '--overwrite/-o' option. When used this will
overwrite the existing configuration file. This allows a site to check
the new config file (at least once) for changes, and then modify their
own 'rkhunter.conf.local' file as required. This option can then be
used to have the installer overwrite the default config file. It saves
having to move the new default config file into place on each computer.
- Locking is now possible when rkhunter runs. This prevents RKH running
more than once and corrupting any modified files such as the log file,
or the file properties file. New configuration options have been added
to handle the locking, and the configuration file contains details of
how the locking works. The default is not to use locking.
- Added support for hash functions SHA224, SHA256, SHA384 and SHA512 using
perl modules Digest-SHA-PurePerl or SHA256, both available at CPAN.
- Added the UPDATE_LANG configuration option. This can be set to those
language files the user wants to be updated when the '--update' option is
used. Since most sites may only use one language, this can reduce the
network bandwidth used. The default is to update all the languages. The
configured default language, and English (en), are always updated.
- Added the ALLOWPROMISCIF configuration option. This can be used to
specify network interfaces which are allowed to be in promiscuous mode.
- Added the SCANROOTKITMODE configuration option. If set to "THOROUGH" then
the scanrootkit function will search for filenames in all directories.
While still not optimal this is one step away from the rigidity of
searching only in known locations. Enabling this feature implies you have
the knowledge to interpret the results properly.
- Added OSX rootkit check.
- Added weaponX rootkit check.
- Added the PKGMGR_NO_VRFY configuration option. This allows specified
files to be exempt from the package manager verification process. Now
that users can include their own files into the file properties check,
it is possible that changed packaged files will cause a warning to be
issued. This option allows those files to skip the package manager
verification, and be treated as non-packaged files.
- Added cb rootkit check.
- Added Fu rootkit check.
- Added ld-linuxv.so.1 LD_PRELOAD check.
- Added Adore Rootkit aka strings.o rootkit aka Dextenea check.
- Added iLLogiC rootkit check.
- Added 'Spanish' rootkit check.
- Added Xzibit rootkit check.
- Added trNkit rootkit check.
Changes:
- Removed the 'os_specific' test for OpenBSD. The *BSD test is currently
only applicable to NetBSD and FreeBSD.
- Updated the ENYE LKM check.
- The '--debug' option no longer needs to be the first option on the
command line.
- Improved support for MAC's now using the bash shell by default. Include
logging of whether 64-bit is available.
- When uninstalling rkhunter, old versions of the document directory
(usually /usr/local/share/doc/rkhunter-*) will now be removed.
- The warnings from the passwd and group file changes tests are now
more specific about what has changed.
- Small change to the detection of Source Mage Linux.
- Renamed part of the 'shared_libs' test to display that it is checking
for preloaded libraries, rather than just the preload file. The pathname
of the preload file is now logged, and any found shared library files are
now logged as a warning.
- The SYSLOG_CONFIG_FILE configuration option can now take the value of
'NONE' to indicate that there is no syslog configuration file, despite
the fact that syslogd may be running.
- Some tests will now show their result as 'Whitelisted'. If a test uses a
configuration option, and this has been set, and the test passes - giving
a green result - then it will now be shown as 'Whitelisted'. The user can
now see that a test has either passed correctly - an 'OK' or 'Not found'
type result - or has passed because the test requirements have been
whitelisted. It is for the user to investigate if this is correct or not.
(This change does not currently apply to all relevant tests.)
Additionally, the configuration option WHITELISTED_IS_WHITE can be set
if the 'Whitelisted' result is to be shown in white rather than green.
For color set two users this will be shown in black.
- Improved the O/S name detection slightly for those systems which only
provide a version number.
- Rkhunter now ensures that the output from the 'lsattr' command, or
'ls -lno' on *BSD systems, and the 'file' command is valid. That is, it
produces something on stdout. If it doesn't, then the 'immutable' and/or
'scripts' test is skipped.
- Changed the RPM spec file so as not to verify the checksum, size and mtime
of the database files and the i18n files. These files may be changed by
rkhunter itself.
- The installer now uses the 'default' layout by default. It is no longer
necessary to specify the layout at all if the default is to be used.
The '--layout' option no longer needs to be the first option specified
if it is used.
- Improved Fleakit Linux Rootkit checks.
- Improved SHV4 Rootkit checks.
- Improved beX2 Rootkit check.
- Improved Phalanx2 Rootkit check to include Phalanx version 2.3d as reported
in ticket 2839813, including a PHALANX2_DIRTEST configuration option which
enables scanning for directory names and accepts the value '0' for default
directory names to search for and '1' for scanning the /etc and /usr
directories for directory names ending in '.p2' at the expense of a slightly
longer running time. Absence of the configuration option selects value '0'.
- Improved Ambient (ark) Rootkit check.
- Improved BOBkit Rootkit check.
- Improved Dica-Kit Rootkit check.
- Improved Evil strings test.
- Improved Possible rootkit files and directories test.
- Improved Suspicious startup file strings test.
- Improved Suspicious open files test.
- Improved Known bad Linux kernel modules test.
- Improved Dreams Rootkit check.
- Improved Universal Rootkit (URK) check.
- Improved FreeBSD Rootkit (FBRK) check and removed standalone ImperialS version.
Bugfixes:
- When using the Korn shell the application check could give a spurious
error printing out '-1'.
- The debug code only partially worked when using the Korn shell.
- Fixed the option parsing in the configuration file such that leading
and trailing whitespace are now correctly removed.
- When displaying the list of checked rootkit names, the list was supposed
to be sorted.
- If the '--list' option was used more than once with the same argument
(e.g. '--list tests --list tests'), it displayed the wrong information.
- The rootkit strings check wasn't logging a warning for the particular
string found. It was, however, displaying an overall test failure
warning on the screen though.
- The rootkit file whitelisting wasn't applied to the startup script
malware check. Also the summary wasn't showing if any possible rootkits
had been found or not.
- If the '--propupd' option was used with either of the '--enable/--disable'
command-line options, then the file properties would not be stored.
However, if, for example, the 'hashes' test was enabled, then only these
would be stored. In all cases the relevant test was not run after the
file properties were obtained, unless the '--check' option was also used.
- The installer now uses a basic 'echo' command. Hopefully it should work
on all UNIX/Linux systems, and avoid any further "-e"'s being displayed.
- Changed how rkhunter detects the Korn shell, and added a test to see if
the 'echo -e' command works or not. As with the installer, this should
allow rkhunter to work on all UNIX/Linux systems, and avoid any further
"-e"'s being displayed.
- When converting the case of characters, unpredictable results could
occur when other languages were specified (via LANG). We now use character
classes rather than the 'a-z' and 'A-Z' ranges.
- For the 'ports' test ensure that only local ports are checked. Also if a
port is whitelisted, the result will say so.
- Using '--hash MD5 --propupd' on a prelinked system caused an error.
- If a non-existent syslog config file was put into the RKH configuration
file, then rkhunter incorrectly said that it was found.
- If the use of prelinking changed, and the 'hashes' test was disabled, then
rkhunter correctly logged a warning (of an O/S change) but did not display
it unless the '--rwo' option was used. It now displays the warning whether
'--rwo' is used or not.
- The 'group_accounts' test now checks /etc/passwd, as well as the shadow
file, for passwordless accounts.
- If the passwd file did not exist, then a warning of this was logged three
times. It is now logged once as a warning, and as an info message for the
other times.
- It was possible for the network ports test to incorrectly display a warning
due to an uninitialised variable.
- The SSH configuration file tests now allow for leading spaces/tabs.
- When using the '--debug' option, and running the 'suspscan' test, the debug
file itself could be logged as suspicious. It is now skipped from the test.
- Ensure the /proc/ksyms or /proc/kallsyms file is readable before using it.
- If the mirrors.dat file has been locally modified to provide a mirror, then
the installer will no longer overwrite the file.
--
* 1.3.4 (31/12/2008)
New:
- Added IntoXonia-NG rootkit check.
- Added Vampire rootkit check.
- Added support for TCB shadow files.
- Added Phalanx2 rootkit check.
Changes:
- The MAIL-ON-WARNING option must now exist in the configuration file. This
avoids it being accidentally misspelt, and rkhunter then not notifying the
user of any warnings.
- The DBDIR directory can now be read-only, after installation, provided that
neither of the '--propupd' or '--update' options are specified, and that the
'--versioncheck' option is not specified if ROTATE_MIRRORS is set to 1 in the
configuration file.
- Renamed the cron job file created by the RPM spec file from '01-rkhunter' to
'rkhunter'. This will then run 'rkhunter' after a prelink cron job (if one exists),
and avoid some of the 'run prelink' errors.
- The system startup file and directory tests have now been merged. The configuration
file options LOCAL_RC_PATH and SYSTEM_RC_DIR have been replaced by the
STARTUP_PATHS option, but, for compatability, they will still be recognised.
- The ALLOWPROCDELFILE configuration option, used to whitelist specific processes
from the deleted files test, can now be followed by a colon-separated list
of pathnames. The given process will then only be whitelisted if it is using
one of the given pathnames.
- The '--propupd' option can now take an optional file, directory or package name
after it. The argument can be a list of names. When used, then only the given
file names will be updated in the rkhunter.dat file. Hopefully this will make
things a bit quicker on slower machines. See the man page for more details. If
using a package manager, then you must run 'rkhunter --propupd' first.
- The Linux 'os_specific' test has now been split into two separate tests -
'loaded_modules' and 'avail_modules'. The tests, however, are the same as
before, they check the currently loaded kernel modules and the names of the
available modules. A new configuration file option has been added, called
MODULES_DIR, so that users can specify which directory, and sub-directories,
are checked for bad module names, should rkhunter be unable to work out the
correct location.
- The pathname of the debug file, if used, is now written to the log file.
Bugfixes:
- Cater for when ROOTDIR is explicitly set to '/'.
- Added an infinite loop check to the readlink.sh supplied script - only 64 levels
of symbolic links are allowed now. Also cater better for top-level names and
links, and file names with spaces.
- Improved the rsyslog remote logging check.
- The wrong error message was shown if the English (en) language file was missing.
- The hidden files and directories check wasn't checking for directories!
- Improved the O/S name detection. Previously the lsb-release file would have
preference to any other file. This could result in some gibberish being given as
the O/S name, rather than continuing to look for other release files. This has
now been fixed.
- The tests against the SSH configuration file now accept the key/value pair to be
separated by an equals sign as well as spaces and/or tabs.
- The file properties inode check did not work correctly when used on non-prelinked
systems with the RPM package manager. The test is now only performed when
prelinking is not being used, and the inode data is always obtained from the disk.
This is a partial fix, as the test should run for scripts regardless of whether
prelinking is used or not.
- The debug file is now created with a random name, and the file permissions are
set to 600.
--
* 1.3.2 (27/02/2008)
New:
- Added support for the socklog and rsyslog (syslog) daemons.
- Added support for IRIX/IRIX64 systems.
- If the user wishes to force RKH to use the 'stat' or 'readlink'
supplied scripts, then this can be set in the configuration file.
The options STAT_CMD and READLINK_CMD, respectively, can be given
the value of BUILTIN to achieve this. For the 'stat' script, perl
must be present.
Changes:
- Improved the 'unsupported language' error message so that the user is
told exactly what command to run in order to see the list of supported
languages. Added a similar comment in the configuration file.
- Errors from applications during the application version check are mostly
now ignored. Improved checking that a valid version has been found.
- The ALLOW_SSH_ROOT_USER and ALLOW_SSH_PROT_V1 options in the configuration
file can now be set to 'unset' and '2' respectively. These values indicate
that the SSH configuration file have no specific value set for the
corresponding SSH option ('PermitRootLogin' and 'Protocol'). RKH will show
the test result in green and as 'Not set'.
- Application names, in the application check, can now be completely
whitelisted. Previously only specific versions were whitelisted, and
RKH had to run the application to find the version. By whitelisting
the application completely, RKH does not have to run it.
- The use of the 'pflog' network interface is now checked for on all *BSD
systems (not just OpenBSD).
- Allow i18n language filenames to contain characters other than just letters.
Bugfixes:
- Scanning the /dev directory in LAZY mode corrupted the pathname being
tested. Also RKH now handles filenames (in /dev) with spaces correctly.
- During the test of files in /dev, MAKEDEV was not being automatically
whitelisted if it exists as an actual file (not a symlink).
- Ensure the suspscan test removes any files it creates.
- The MAIL-ON-WARNING configuration file option and the --no-verbose-logging
command-line option, are now only logged if the system is being checked.
- Root equivalent and passwordless account names are now shown correctly.
Previously, names which contained spaces, for example if the account had
been manually commented out, were only shown up to the first space character.
- Whitelisted passwordless account names are now logged.
- Suspscan warnings were being ignored by the rkhunter summary and return code.
- Corrected obtaining process names in Solaris for the network ports and
deleted files tests. Previously they did not report the name correctly, if
at all.
- Use of the '--debug' option with the Korn shell was not working correctly.
- Reset the SIGPIPE handler to its default to avoid pipe output errors.
- Language files may contain backticks. These are now escaped during
processing.
- Unset the MANPATH in the spec file to allow the RPM to be built on
OpenSuSE systems.
- The hidden files/directories test would try and run even if no 'file'
command was present.
- Cater for *BSD systems using the fdesc/fdescfs filesystem on /dev/fd.
--
* 1.3.0 (22/09/2007)
New:
- Created an ACKNOWLEDGMENTS file.
- Added configuration file option MAIL_CMD when MAIL-ON-WARNING is used.
This can specify the 'mail' command to use and the subject line.
- The log file can be appended to. This can be set in the config file or
by using the --append-log command line option.
- A second colour set has been added for users using rkhunter with black
characters on a white screen. The command-line option --cs2 will enable it.
- Added special config file and command-line option, -x/-X, to detect if X
is in use. If detected then second colour set will be used.
- Added '--propupd' option. This allows a user to create the rkhunter.dat
file. This file contains the O/S name, file hash values and other bits of
information. If the file hash values change, perhaps due to new versions
of software, then the user simply runs rkhunter with the option again. If
the user has not run rkhunter with this option, then the file properties
checks are skipped. This option obsoletes the 'hashupd.sh' script previously
recommended to users. If use of the '--propupd' option is suggested by
the program, then the log file will contain a warning message to the
user that they must ensure that the commands checked on their system must
have been installed and verified as being genuine. The file properties
check consists of two main parts - the file attributes (permissions, uid
etc), and the hash value. Both are stored in rkhunter.dat. Either part, or
both, can be disabled using the '--disable' option.
- Added the '--hash' command-line option, and the HASH_FUNC option to the
configuration file. This allows a user to select the hash function command
they want to use for the file hash value check and the properties update.
By default SHA1 will be used, or MD5 if SHA1 cannot be found. For prelinked
systems the function must be either MD5 or SHA1. A value of NONE can be used
to disable the hash check or to stop the hash values being recorded in the
rkhunter.dat file.
- Added the HASH_FLD_IDX option to the configuration file. This specifies the
field of the HASH_FUNC command output which contains the hash value. A
default of 1 is used, except for *BSD systems where 4 will be used.
- The files for the file hash checks are now 'looked for'. The code will
search the command directories, and check the relevant files in all the
directories. Additional commands and directories are used for Solaris,
MAC OS X, NetBSD and FreeBSD systems. Overall more commands will be checked.
- Added support for Ubuntu, and the 'dash' and 'ash' shells.
- If the O/S name, architecture or prelinking status changes from one rkhunter
run to the next, then a warning message is written to the log file and the
file properties prerequisite check will fail. The change may well cause the
file hash checks to show false positives. (The user should rerun rkhunter
with the --propupd option.)
- Rkhunter will now check that certain commands are present before starting
any checks. This avoids spurious 'command not found' type messages
suddenly appearing.
- Added basic internationalization (i18n) functionality. The messages
displayed during test processing are obtained from an indexed file.
This file can be translated in to other languages, keeping the index
the same. To see which languages are provided use the new
'--list languages' option. Chinese translation provided.
- Added two new command-line and configuration file options, '--enable'
and '--disable' to specify which tests are to be carried out and which
are to be ignored. Use of either option will automatically assume '--check'.
- To list the available test names, use the new '--list tests' option.
- The '--update' and --versioncheck' options can now use commands other than
wget to download files. Supported commands are now wget, curl, elinks,
links, lynx, bget and GET. Once a command has been found, it will be used
for all downloads. Since bget and GET are perl commands, checks will be
made that any required perl modules are also present on the system.
- (SF Tracker 1616395) Added '--syslog' cli option, configuration file option
USE_SYSLOG. This will allow the --check option start and finish time to
be logged via syslog. The facility/priority are user configurable.
- Added --debug cli option, and allow commands to be configured in the
configuration file. Both of these additions are for the developers, but
may be used when debugging user problems.
- Added command-line options '--summary/--nosummary' (--ns). These control
whether the system checks summary is shown. By default it is shown.
The '--summary' option, as well as the '--report-warnings-only' option,
will override the '--quiet' option if they are specified. However, no
other information will be displayed if '--quiet' is used.
- Added SunOS SInAR rootkit check.
- Added '--verbose-logging/--no-verbose-logging' options. This cuts down on
some of the logging for some of the tests. By default verbose logging is
enabled.
- The inetd and xinetd configuration file pathnames can now be specified
in the rkhunter configuration file. Also, enabled inetd and xinetd
services can now be whitelisted.
- Added support for Solaris 10 inetd mechanism (inetadm).
- The directory containing the SSH configuration file can now be specified
in the rkhunter config file.
- The pathname to the syslog configuration file can now be specified
in the rkhunter config file.
- The use of syslog remote logging can be allowed in the configuration file.
- The pathnames to the local system startup file (rc.local), and the
startup directory (/etc/rc.d) can now be specified in the rkhunter
config file.
- Files in /dev can now be whitelisted.
- Application version numbers can now be whitelisted. This caters for those
distributions that may patch a 'known bad' version, but without updating
the original version number.
- Added 'suspscan' to malware tests. Suspscan attempts to scan files in
directories containing temporary files for signs of malicious activity, and
could be of use on (publicly accessable) web servers running for instance
PHP-based applications. Please note that in it's current state suspscan is
prone to reporting false positives, and is CPU and I/O intensive to boot.
Therefore suspscan is disabled by default. Please do not enable suspscan
unless you have good reasons to use it. Review the settings in the configu-
ration file, and test before deploying it on production servers.
- Added the command-line option '--pkgmgr', and the configuration file option
PKGMGR. These provide support for package managers when using the
'--propupd' and '--check' options. Currently supported package managers are
'RPM' for RedHat/RPM-based systems, 'DPKG' for Debian-based systems, and
'BSD' for *BSD systems. Additionally, 'NONE' can be used to indicate that
no package manager is to be used. The default is 'NONE'. See the README file
for more details.
- It is now possible to configure rkhunter to use local or remote mirrors,
rather than just the SourceForge one. This applies when either the
'--update' or the '--versioncheck' option is used. The default is to use
all defined mirrors. The README file has more details about this.
- It is possible to configure rkhunter to not rotate the mirrors.dat file.
It is also possible to configure the mirrors file not to be updated when
the '--update' option is used. Both of these options can be useful when
defining local mirrors. The README file has more details about this.
- Added a file size check to the file properties checks. This will only occur
for non-prelinked files, files not part of a package, or packaged files
when the RPM package manager is being used.
- Network ports listed in the backdoorports.dat file can now be whitelisted.
Specific protocol/port pairs, or pathnames to allowed executables, may be
used. Additionally, an asterisk may be used to indicate that trusted
pathnames will be allowed. The configuration file has more details about this.
- The O/S 'release' file pathname may now be configured. This option should only
be necessary for those systems on which rkhunter cannot automatically
determine the O/S name or version.
- Rootkit files and directories, including those with spaces, may now be
whitelisted in the configuration file.
Changes:
- Improved command-line and config file option checking.
- The log file is now created by default, it can be disabled in the config
file or by using the --nolog command line option. The log file is created
with permissions 600.
- The log file cannot be a symlink.
- Multiple recipients may be specified with the MAIL-ON-WARNING config option.
- Added BINDIR and ROOTDIR options to the config file.
- Split out the README file in to README and FAQ files.
- Solaris will now use the bash shell if available.
- Expanded the command PATH used to include the /opt/sfw and /usr/sfw
directories for Solaris users.
- Expanded the command PATH used to include the /usr/pkg directory for
NetBSD users.
- Expanded the command PATH used to include the /System/Links/Executables
directory for GoboLinux users.
- Versioncheck now checks the versions numerically.
- The HASHWHITELIST configuration file option has been removed. It is no
longer required because users can now create their own file of hash
values using the '--propupd' option.
- The '--checkall' option has been changed to '--check'. The old option is
still recognised, but will be deprecated at some time.
- If a log file is to be written, but not appended to, then the old log file
is moved to '<logfile name>.old' now. The same happens to the rkhunter.dat
file if the --propupd option is used.
- The previous 'known good' hash check now also checks the files inode, uid,
gid, permissions and modification date/time, for any changes. The latter
is only for non-prelinked systems. As before, in all cases, the file hash
is checked. (This is now the file properties check.)
- Improved the O/S detection mechanism. Rather than requiring users to send
us details, rkhunter actively looks at the 'release' file(s) to find the
O/S name. Included support for some lesser-known Linuxes - GoboLinux,
Lunar Linux, Rock Linux, Source Mage Linux, Kanotix, Sidux and Zenwalk.
- If the --propupd or --update options are used, as well as the system
check option --check, then the update checks are performed before the
system is checked. Previously the update occurred after the system was
checked.
- Hidden file search now checks /usr/share/man directories.
- Improved NetBSD support.
- The supplied perl scripts, providing the stat, md5 and sha1 commands,
can now be executed without perl being in the default directory (/usr/bin).
- If a perl script is to be used, then a check is made that required modules
are installed on the system. If they are not, then it is treated the same
as if perl was not present.
- Included the /usr/share/man directories when looking for hidden files.
- Check for symbol entries in kallsyms file if ksyms does not exist.
- Enabled sockstat/netstat test for all BSD variants (not just FreeBSD).
- Enabled backdoor port test for all systems which have either the 'lsof'
or 'netstat' command. However, if the netstat syntax is not understood
on the O/S, then an error is shown. (The user can configure the test to
be disabled to avoid the error.)
- The TMPDIR configuration option and --tmpdir command-line option cannot
be set to /tmp or /var/tmp because files will be copied and left there.
It cannot be set to /etc either because files will be deleted from there.
- Removed the '--scan-knownbad-files' option. This test was considered to
be obsolete.
- Removed the '--disable-md5-check' option. This is now the 'hashes' test
name, and can be disabled by the '--disable' option.
- Removed the '--allow-ssh-root-user' option from the command-line. This
can still be set/unset in the configuration file. This option must now
be set to the value of the 'PermitRootLogin' option in the SSH config
file. This then allows root access to be set, but will check to see if
the option has changed. A default value of "no" is used.
- The --rootdir/ROOTDIR configuration option has been changed to be more
intuitive. Previously the specified ROOTDIR had to end in a slash (e.g.
'/abc/'). Now this is not necessary, a normal directory name can be used
(e.g. '/abc').
- The '--versioncheck' option now rotates the mirror file. It also assumes
program defaults if the mirror file is missing or empty, or if no mirrors
are found within it. Additionally if the URL is missing from the
configuration file, then a program default is used. This allows the option
to work even if the files have become a bit corrupt. Any missing files or
mirrors are logged to the log file. If a mirror fails, then the next
mirror is used, until all the mirrors have been tried. Only then is a
failure message displayed, and the return code set. The return code will be
set to 0 if no error occurred, 1 if an error did occur, and 2 if no error
occurred but a new version is available.
- The '--update' option will use a default mirror if the mirror file is
missing or empty. If a mirror fails then the next mirror is used. If a file
has become corrupted such that the version number cannot be read, then a
new copy will be downloaded. The return code will be set for this function.
It will take the value of 0 for no error, 1 for an error, and 2 for no
error but an update has occurred. This allows a user to use the --quiet
option, but still check for the return code.
- The version numbering of the '.dat' database files has changed. This makes
them incompatable with previous versions of rkhunter, and as such files
from previous versions will be overwritten if used with this version.
- The displayed output and logged output are now similar. This allows
checking the log file to be easier when looking for specific tests. The
log file will, of course, log more information than is displayed on
the screen.
- Script replacement check now checks for any type of script (perl, awk, etc).
Previous versions only checked for shell scripts. Commands which are
supposed to be scripts can be whitelisted in the configuration file.
The 'rkhunter' command itself is an exception, and the check will ensure
that 'rkhunter' is a shell script. The script check will be automatically
skipped if a package manager is being used, and the file has already
passed the file size and hash checks.
- File permissions check improved to check if 'other' has the 'w' bit set.
Previous versions only checked if '777' ('rwxrwxrwx') was set. Merged this
into the file properties checks. Soft links are ignored, as are packaged
files when the RPM package manager is used.
- The '--report-mode' option has been removed. It was not seen as being
useful, and combinations of the other options will provide the same, if
not better, reporting.
- The xinetd.conf check now handles the 'include' directive. It also now
handles the 'includedir' directive in all files, and not just in the
initial xinetd configuration file.
- The '--display-logfile' option can now be used after any option. Previously
the log file was only shown after checking the system.
- The checks on accounts and the password and shadow files, have been improved.
The user can configure the pathname to the password and shadow files, as
well as being able to whitelist accounts with no password or which are root
equivalent. *BSD support improved.
- Improved the hidden files and directories checks. Some directories are now
searched more thoroughly, and checks against the file type are more robust.
- Apache backdoor test now looks in more places.
- The application version check no longer checks against known 'good'
versions. Only a file of bad versions is kept. The previous method was
impossible to maintain.
- Enabled the immutable file test for *BSD systems.
- Soft (symbolic) links for files and directories are now handled correctly.
Previously the link was dealt with, but not what it pointed to. Soft links
are dealt with when using the '--propupd' command, and when running the
file properties checks. For those systems with no 'readlink' command (e.g.
Solaris), or those in which readlink does not understand the '-f' option
(e.g. NetBSD), a shell script is now provided to support this.
- RPM spec file and installer now caters for x86_64 machines. Removing the
RPM now more fully removes RKH; only the rkhunter.conf file should remain.
Bugfixes:
- Command-line options requiring an argument now work correctly under Solaris.
- The -h/--help option now works as expected.
- The 'ignoKit rootkit' check was not checking all the required files.
- Some checks were not respecting the ROOTDIR option in their pathnames. This
has now been corrected (possibly not completely though). Also, some tests
were using ROOTDIR pathnames in grep/strings checks when they shouldn't
have been. This has also been corrected.
- The file hash prelink test should now work even if SELinux objects to the
prelink command (provided the 'runcon' command exists). When the '--propupd'
option is used, any file for which a hash cannot be obtained is logged as
a warning. (Typically prelink may need to be run on the file.) Rkhunter will
still work as before, but the file properties check may show that the hash
value has changed to or from a null value.
- Corrected file attributes check - previously the immutable flag would never
have been found.
- Backdoor UDP port tests were not being done correctly. The TCP port tests
have been made a bit more aggressive - TCP tests only look for TCP ports;
they also look for established connections rather than just listeners.
- Backdoor port data file (backdoorports.dat) is now part of the '--update'
process.
- The '--versioncheck' option did not set the return code. It now does so.
However, note that if an update is available then the code will be set
to '2'. This allows use of the '--quiet' option, but still being able to
detect if an error occurred (code 1), an update is available (code 2) or
if no error occurred and no update available (code 0).
- Corrected bug in Solaris script replacement check. The tested output is
never used on Solaris, so previously the test would never have worked.
- The '--quiet' option now does what it says. No output is shown unless other
options are specified by the user. E.g. using '--quiet' on its own produces
no output, but sets the return code. If the '--report-warnings-only'
option is used as well, then warnings will be shown despite '--quiet'
being used.
- Enabled the login backdoor check. It was coded, but used the wrong variable.
It also checked for directory names rather than file names. This looked
wrong, but I could not find any more info about it. As such we now check
for their existence rather than whether they are files or directories.
- Corrected the suspicious directories check.
- The xinetd.conf check only occurred for Linux systems. It will now occur
for all O/S's. Also, the check always reported the file was clean,
regardless of whether this was true or not.
- The hidden files and directories check was not working correctly for
Gentoo users.
- Small bug in T0rn rootkit file list.
--
* 1.2.10 (Not released)
New:
- Enabled Ohhara Rootkit check
Changes:
- If duplicate configuration file options are seen, then only the last
one seen is used
Bugfixes:
- Lsof resolution fix
- Fixed Danny Boy's Abuse Kit check
- Fixed SHV5/Tripwire check
- Fixed ignoKit check
--
* 1.2.9 (30/09/2006)
New:
- Rootkit Hunter is under new management so maintenance, development and support is assured
- Added support for RHEL WS/AS/ES 3, Taroon update 8
- Added support for Fedora Core 5
- Added support for SuSE 10
- Added check for packet capturing applications (see rkhunter.conf for whitelisting)
- Added check for processes using deleted files (see rkhunter.conf for whitelisting)
- Enabled netstat check for AIX
- Enabled backdoor check for SunOS
- Enabled logfile specification and checks
Changes:
- Improved cAos support
- Improved AIX rc.sysinit test
- Improved second promiscuous mode check
- Improved prelinking test
- Improved binaries found check
- Improved MD5 check and application scan
- Improved FreeBSD/AIX grepping
- Improved Solaris grep/ifconfig (FP's)
- Improved reportmode report-warnings-only
- Improved permitrootlogin check with forced-commands-only
- Improved passwordless user accounts test
- Improved file/module name checks (FP's)
- Improved check-update: DBDIR vs temp dir and preserve DAC rights
- Improved Solaris script replacements
- Fix typos, grammatical changes, formatting/displaying
- Added more examples to config
- Change contact information
Bugfixes:
- Removed stale mirrors
- Fix SF tracker issue 1449701
- Fix skdet test
- Time uses Perl epoch
- Error message about "group" file
- Ksh 'shift' fix
--
* 1.2.8 (24/02/2006)
New:
- Added '-sk' alias (instead of --skip-keypress)
- Added support for Fedora core 4
- Added support for FreeBSD 4.11, 5.2, 5.3, 5.4, 6.0
- Added support for CentOS 3.3 ('final' and 'Final')
- Added support for CentOS 3.5, 4.1 and 4.2
- Added support for Debian 3.1 (AMD64)
- Added support for RHEL WS/AS/ES 3, Taroon update 6
- Added support for RHEL WS 4, Nahant Update 1 and 2
- Added support for Slackware 10.2
Changes:
- Updated RHEL hashes
- Updated Fedora Core 3 hashes
- Updated SuSE 9.1 hashes
- Updated software database
- Update copyright line
--
* 1.2.7 (24/05/2005)
New:
- Added support for CentOS 4.0
- Added support for Mandrake 10.2
- Added support for Gentoo (sparc/sparc64/x86)
- Added additional support for E-smith (SME 6.0.1)
- Added support for FreeBSD 4.5 and 4.6
Changes:
- Improved support for Bind (thanks to Craig)
- Improved support for RHEL AS release 3
- Updated hashes for SuSE 9.1 (core-utils)
Bugfixes:
- Fixed problem with the updater (file was retrieved, but not placed within
the correct directory)
--
* 1.2.6 (10/05/2005)
New:
- Added support for Tao Linux
- Added support for Trustix 2.2 (Sunchild)
Bugfixes:
- Fixed problem with updater
--
* 1.2.5 (03/05/2005)
New:
- Added support for FreeBSD 4.11 (i386)
- Added support for RHEL AS release 3
- Added support for Cobalt (6.5.1)
Changes:
- Fixed permissions of check_update.sh
- Fixed typo in help
- Improved detection for some unknown rootkits/backdoors
- Improved messages/logging
- Some code cleanups
- Important: fixed a security issue, related to temporary files
--
* 1.2.4 (25/04/2005)
New:
- Added support for E-smith (SME 6.0)
Changes:
- Updated hashes for Fedora core 2
- Improved documentation of tools (see tools directory)
- Removed logging from installer
Bugfixes:
- Fixed problem when using --allow-ssh-root-user (option was overwritten
by configuration file option)
--
* 1.2.3 (21/03/2005)
New:
- Added option to allow/whitelist hidden files and directories. See
configuration file
- Added support for SuSE 9.2 (x86-64)
Changes:
- Updated configuration file, to give more information about
whitelisting of hidden files/directories
- Updated Fedora core 3 hashes (procps package)
- Updated packages: OpenSSH
- Updated manpage
- Improved logging
- Added debugging info for named
- Strip off patch version with PHP port (Debian)
- Extended support for Fink (MacOS), added /sw/bin to BINPATHS in
check_update.sh
- Improved installer when /usr/local/bin is missing
Bugfixes:
- Fixed problem with unquoted variable (passwordless accounts)
--
* 1.2.2 (18/03/2005)
New:
- Added support for Mandrake 10.1
- Added hashes for Mandrake 10.1. Thanks to Roderick B. Greening
- Added support for RHEL WS release 3
- Added support for NIS when looking for passwordless accounts
- Added support for beX2 (evil code)
Changes:
- Updated Debian hashes
- Changed permissions of installer (0755 instead of 0750)
- Changed installer so normal users can install rkhunter. This is
experimental, so check is commented in installer
- Updated packages: Bind, Exim, OpenSSL
- Improved logging
- Small layout fixes
- Code cleanup
- Updated mirror list
- Updated copyright message (2005)
Bugfixes:
- Changed symbols when one or more groups are added/removed
--
* 1.2.1 (21/02/2005)
New:
- Added support for Mandrake 8.1 (i586, no hashes)
- Added support for FreeBSD 5.3 (i386, with hashes for release version)
- Added support for Slackware 10.1
- Added Turkish translation to installer (note: language support
temporarily disabled)
- Added support for Fink (MacOS), added /sw/bin to BINPATHS
- Added contrib directory
- Added script (contrib) run_rkhunter, by Andy Spiegel
Changes:
- Updated hashes for SuSE 9.1, Mandrake 10.0
- Updated installer (changed copyright line, comments and disabled
version number, because it can be confusing when installer version
is another version than main version.)
- Perform extra check before checking configuration file (to see if
it exists)
- Improved logging (show temporary directory, improve output when
scanning for default rootkit files/directories)
- Improved output when system is unsupported
- Stop program when temporary directory doesn't exist instead of
creating it
- Updated packages: Apache, Bind, GnuPG, OpenSSL
- Fixed some typos
Bugfixes:
- BINPATHS got overwritten when performing software version check
- Fixed bug when checking for ssh root user. Thanks to Andy Spiegel
- Clean up temporary prelink file
Website:
- Added notification list
- Fixed some XHTML bugs
--
* 1.2.0 (10/02/2005)
New:
- Added support for CentOS 3.4
- Added new configuration option 'ALLOW_SSH_ROOT_USER' and program
parameter '--allow-ssh-root-user' to allow directly login of a
`root` user, in your SSH configuration file.
Changes:
- Updated hashes for Fedora Core 1, Core 2, Core 3
- Changed RHEL 3, so taroon 4 uses the hashes of taroon 3
- Updated Debian hashes
- Removed ClamAV from application scan. It warns the user now when
it runs an too old version.
- Updated manpage
- Changed detection for SuSE versions. SuSE Linux Enterprise Server
didn't work, because of the capitals (instead of the usual name)
- Warn if user uses /tmp as temporary directory (possible security
issue)
- Updated wishlist/todo and manpage.
Bugfixes:
- Fixed wrong message when group was added/deleted from /etc/groups
--
* 1.1.9 (28/12/2004)
New:
- Added RH-Sharpe's rootkit (rootkit)
- Added SHV5 rootkit (rootkit)
- Added special test for tripwire
- Added support for metalog (syslog daemon)
- Added support for ALTLinux 2.2 and 2.4
- Added support for CentOS 3.3
- Added support for Gentoo 1.6
- Added support for FreeBSD 4.10 (alpha platform)
- Added support for SuSE SLES8. Thanks to Mario Lenz
- Added support for SuSE 9.2 (i586)
- Added support for Fedora Core 3
- Added support for Red Hat Enterprise Linux ES/WS release 4
- Added hashes for Fedora Core 3. Thanks to Steph
- Official port is now available for ALTLinux
- Change text when an old software package has been found. This
will happen with backporting operating systems (Red Hat,
Fedora etc)
Changes:
- Improved logging for lsof test
- Updated hashes for Fedora Core 1
- Updated hashes for Debian woody
- Updated hashes for Red Hat Enterprise Linux ES/WS release 3
- Updated hashes for Slackware 9
- Updated hashes for Slackware 10
- Updated hashes for SuSE 9.1
- Updated wishlist/todo, updated readme and manpage.
- Code cleanup (added more remarks, cleanup of old/buggy things)..
- Improved logging
Bugfixes:
- Changed binary search path due typo. Thanks to Bertrand
--
* 1.1.8 (12/09/2004)
New:
- Added support for Red Hat 6.2 and hashes. Thanks to Sebastian Herbszt
- Added support for Red Hat Enterprise Linux ES 3, Taroon update 3
- Added support for Red Hat Enterprise Linux AS 3, Taroon update 1
Changes:
- Improved Suckit detection
- Improved FreeBSD version detection. It now will skip MD5 check if sysctl
contains 'release', but patches for primary binaries are installed (like
ls, ps, top etc)
- Added error redirection when performing lsattr checks
- Added `find` to path search
- Updated installer with portogues/brazilian language. Thanks to Douglas
- Updated hashes for Red Hat Enterprise Linux 3
- Updated hashes for Slackware 10
- Cleaned up logging when checking for passwordless accounts
- Show message when bad hashes are found. Some scared people began to worry
inmediately after they found several bad hashes, without understanding the
reason of it (reason: updated packages).
- Improved output in logging which deals with updated packages / hashes
- Improved logging (informational logging)
- Improved output of hidden directories/files. Thanks to Greg Houlette
- Corrected some parts of logging
- Code cleanup
Bugfixes:
- Forgot to initialise LSATTRFOUND
--
* 1.1.7 (29/08/2004)
New:
- Added support for ADM Worm
- Added support for MzOzD and spwn backdoor
- Added LKM filename check (experimental)
- Added passwordless user account test
Changes:
- Updated Mandrake 9.2 hashes. Thanks to Eric Gerbier
- Updated application version list
- Extended inetd.conf test (searches for shells)
- Added total of vulnerable applications at report, if application scan was
performed.
Bugfixes:
- Fixed a major bug in the installer when you install version 1.1.5 or newer. The
sample configuration won't be copied and the due to that, the --update function
won't work.
--
* 1.1.6 (18/08/2004)
New:
- Added support for RSHA's rootkit (rootkit)
- Inspect files attributes (immutable detection)
- Added '--update' to help text. Updater seems to be stable
- Added FreeBSD packages database test (pkgdb). It performs an automatic
fixup of the database and displays an error when problems were found.
- Added '--skip-application-check' option. This skips the program version
check. On some systems it's half useless, because they use patched
(old) version numbers.
Changes:
- Improved report at end (hide line when no rootkits are found)
- Updated hashes for SuSE 9.1 (i586)
- Fixed double hash in database
- Updated database with program versions
- Added more help and informational messages
Bugfixes:
- Improved installer (when last line contains no newline char, the INSTALLDIR
option was added on the wrong place)
--
* 1.1.5 (11/08/2004)
New:
- Added support for Ni0 Rootkit (rootkit)
- Added 'open files' check
- Added OpenSSL check
- Added Solaris 9 support
Changes:
- Improved logging of application scan check
- Improved xinetd.conf tests (disabled some parts, due false positives)
- Improved logging on different places (more breaks etc)
- Improved SunOS support. Thanks to Michael Gueting
- Improved (POSIX compatible) applications support for SunOS
- Fixed a typo (application version check)
- Fixed a typo (SSH check)
- Fixed small layout issue at application scan check
- Removed an double declared variable (WARNING=0)
Bugfixes:
- Fixed missing lines in rkhunter.spec file
- Installation script shouldn't be overwriting rkhunter.conf file..
--
* 1.1.4 (07/08/2004)
New:
- Added support for FreeBSD 4.10
- Added support for White Box Enterprise Linux 3.0
- Added support for Debian 3.1 (Sid)
- Added support for OpenBSD 3.5 (i386 and sparc64)
- Added support for SunOS. Thanks to Michael Gueting
- Added boot.local test for SuSE 9.x
- Added Apache test
- Added support for mod_rootme module (apache backdoor)
- Added option '--display-logfile'. It displays the logfile you specified
at the end of the output (don't forget to use --create-logfile)
- Added application version checker
Changes:
- Don't quit when wget cannot be found during install
- Updated installer (for new update function)
- Updated MD5 hashes for Mandrake 9.1
- Updated MD5 hashes for Slackware 9.1
- Updated MD5 hashes for FreeBSD 5.2.1
- Improved logging in quiet mode
- Improved key pauses when in 'interactive' mode
- Improved xinetd check
- Improved report-mode option (--report-mode). If you want a small amount of
information (ie. if you scan a lot of servers), use this option.
- Updated document location in installer
- Updated the wishlist. A lot of issues are solved now.
- Updated changelog (had some little typos)
Bugfixes:
- Fixed false positive when using Debian
- Fixed support for PLD Linux and CPUBuilders Linux
- Fixed a typo in the installer
--
* 1.1.3 (20/07/2004)
New:
- Added support for SuSE Linux Enterprise Server 8. Thanks to Daniel Berlin
- Added support for SuSE Linux Openexchange Server 4.1.1. Thanks to Daniel Berlin
- Added support for Fedora Core 2 with 64 bits support
- Added support for TDB database (/dev related)
- Added hashes for FreeBSD 5.2.1
* Added tools directory in tarball with a experimal auto-updater. Use it on your
own risk and check the script before you run it!
Changes:
- Improved Suckit support (rootkit)
- Improved user detection (the check will now handle NIS users fine when
checking for UID 0 alike users)
- Improved logging on multiple sections
- Updated parameter list (--help), to reflect changes (--quiet)
- Updated hashes for Mandrake 10
- Updated installer. With a SunOS improvement by Michael Gueting.
Bugfixes:
- Quiet-option is now really quiet (xinetd line still appeared when running in
quiet mode)
- Fixed a problem with the binary UPX scan (multiple error lines appeared)
--
* 1.1.2 (14/05/2004)
New:
- Added string check. This checks some binaries which often get trojaned.
- Added '--quiet' option. Very usefull when running Rootkit Hunter as a cronjob
and don't want to see all the output (EXCEPT when warnings/errors has been
found)
- Added xinet daemon test. Thanks to unSpawn and Andrea
- Added test for binaries (UPX)
- Added alias '--create-logfile' for '--createlogfile'
- Added support for Mandrake 8.2
- Added support for Mandrake 9.0
- Added support for Mandrake 9.1
- Added support for Redhat Enterprise Linux AS (Taroon update 2). Thanks to Yann Le Guennec
- Added support for Slackware 10. Thanks to Fred Bulthuis
- Added support for Gentoo 1.5. Thanks to Nicolas Kaiser
- Added support for some Gentoo ppc versions
- Added hashes for Slackware 10
Changes:
- Improved support for AIX and OpenBSD. Thanks to Iain Roberts
- Improved support for rootkits (Dica, Dreams, Fuckit, MRK, Ohhara, Sin, SunOS Rootkit
and TBD Rootkit)
- Updated hashes for Fedora Core 2
- Updated hashes for SuSE 8.2. Thanks to Jack Denman
- Updated installer
Bugfixes:
- Fixed another problem in the installer
- Fixed a problem with the updater (not yet in use)
- Changed output of `ps` when checking for syslog daemon (should fix a problem on some
systems where the output was too long)
--
* 1.1.1
Bugfixes:
- Fixed a problem with the installer.. (wrong shell)
--
* 1.1.0
New:
- Added support for Red Hat Linux Advanced Server 2.1
- Added support for Slackware 9.0. Thanks to Stan Cosmin
- Added support for Slackware 9.1. Thanks to Fred Bulthuis
- Added support for Trustix 2.0. Thanks to Agung Ud
- Added support for Debian with sparc64 architecture (testing/unstable)
- Added hashes for Slackware 9.0
- Added hashes for Slackware 9.1
Changes:
- Updated SuSE 9.1 hashes
- Updated Mandrake 10 hashes
- Updated Fedora Core 1 hashes
- Updated Fedora Core 2 hashes
- Updated OpenBSD 3.3 hashes
- Updated Suckit (rootkit), multiple improvements
- Updated rkhunter.spec file. Thanks to Craig Orsinger
- Updated installer. Thanks to Iain Roberts
- Added mirrors.dat to file checks
Bugfixes:
- Fixed WHITELIST option again (it stripped the wrong characters: when a hash
contains a '5', it got stripped)
- Updated sockstat/netstat check for FreeBSD
- Skipping of MD5 didn't work anymore (due a forcefully check when Perl module
Digest::MD5 was found). Thanks to Zac
--
* 1.0.9
New:
- Added support for Balaur Rootkit (rootkit)
- Added installdir option to the installer
- Added INSTALLDIR option to configuration file
- Added support for SuSE 9.1 (pro)
- Added support for Fedora Core 2
- Added support for RHEL 3 Taroon update 2
- Added support for PCLinuxOS (HD-install)
- Added hashes for SuSE 9.1
- Added hashes for Fedora Core 2
- Added hashes for Mandrake 10
Changes:
- Updated hashes for Fedora Core 1 (updating prelinked hashes is no good
idea..) Thanks to Doncho.
- Updated hashes for SuSE 8.2
- Updated hashes for Mandrake 9.2
- Updated hashes for RHEL 3 Taroon update 1 and update 2. Thanks to Tom and Eilko
- Improved hidden file detection
Bugfixes:
- Added prelink check, to resolve some problems with a few Fedora Core 1
installations. Thanks to Mike Haslam for pointing out this problem.
- Changed detection of syslog daemon
- Fixed a problem with the MD5WHITELIST option (see rkhunter.conf). Thanks to
John P. New
- Updated installer (added /usr/local/etc to directory check, because some
systems don't have this directory by default)
--
* 1.0.8
New:
- Added support for Mandrake 10 (official release). Thanks to Dave Edwards
- Added support for Slackware 9.1.0. Thanks to Zebul666
- Added hashes for Red Hat Enterprise Linux 2.1 (Panama). Thanks to Duke
(mastre). (+1 beer for me)
Changes:
- Updated hashes for Red Hat Enterprise Linux 3
- Updated hashes for Fedora Core 1. Thanks to Greg Houlette
- Updated rkhunter.spec file by Doncho
- Improved extra Suckit tests. Check the presence of `stat`, before performing
the scans. Reported by Pasi.
--
* 1.0.7
New:
- Added support for Irix Rootkit (rootkit)
- Added support for URK (Universal Root Kit) (rootkit)
- Added 'whitelist support' for MD5 hashes. See configuration file for more
information about this new option.
- Added improved support for Yellowdog 3.0 (Sirius). Thanks to P. Hopkins
Changes:
- Improved Suckit detection (multiple improvements). Thanks to unSpawn!
- Fixed problem when running a special listener under FreeBSD (i.e. a DHCP
daemon). Thanks to Yann Nottara
- Fixed wrong text with 'rootdir' option. Thanks to Doncho N. Gunchev
- Fixed typo with '--dbdir' parameter. Thanks to unSpawn.
- Fixed rkhunter.spec file. md5blacklist.dat was missing. Thanks to Masanari
Iida
- Fixed a problem with the $rootdir
- Improved rkhunter.spec file. Thanks to Doncho N. Gunchev
- Improved Perl version detection. Thanks to Doncho N. Gunchev
- Updated installer to support dynamic paths soon.
- Layout improvements for installer
- Changed copyright text in main binary and installer (as required/suggested
by GPL)
- Updated website (FAQ, documentation)
--
* 1.0.6
New:
- Added support for FreeBSD 4.9 and 5.2.1
- Added support for SuSE 9.0 (i386 and i586). Thanks to multiple people
- Added support for Trustix. Thanks to Joachim Holst
- Added support for Whitebox Enterprise Linux 3.0. Thanks to Fire
- Added support for CentOS 3.1. Thanks to Fire
- Added support for Mandrake 10 (community release). Thanks to Ted Kline
- Added support for CPUBuilders Linux. Thanks to Chris Locke
- Added support for Gentoo's 'rc.local' file (local.start)
- Added parameter '--bindir' to use another (binary) directory than the default
ones (to select which binaries will be used to perform the tests). Requested
by Joel.
- Added parameter '--configfile' to use another configuration file.
- Added parameter '--dbdir' to use another (dynamic) database directory
- Added a check when dynamic parameters are used (like --dbdir, --bindir) to
check the existance of these paths/files.
- Added lsmod check (/proc/modules) for Linux distros. Thanks to Micah Anderson
Changes:
- Updated hashes for Mandrake 9.2. Thanks to John P. New and others.
- Updated hashes for Red Hat Enterprise Linux Update 1. Thanks to Eilko
- Added informational message, when 'PermitRootLogin' or SSH protocol 1 is found,
into the logfile
- Renamed .spec file to rkhunter.spec
- Updated installer. Thanks to Uwe Hermann
- Improved LKM check. Thanks to Joe Croft
- Improved logging
- Fixed a problem with ifconfig
--
* 1.0.5
New:
- Added 'ignoKit' (rootkit)
- Added support for Red Hat Linux 8.0 (Psyche)
- Added option '--disable-passwd-check', to disable passwd/group check. Suggested
by Michael Niehren
- Added option '--scan-knownbad-files', to scan besides the 'known good' MD5 checks,
a lot of system binaries against a 'known bad' database.
- Added option '--tmpdir', to specify a temporary directory instead of the static
one (see below, at 'tmpdir' option within the configuration file).
- Added a 'known bad' database with a lot of 'blacklisted' binaries and tools
(like sniffers, rootkits, backdoored binaries, IRC tools etc)
- Added hashes for Red Hat Enterprise Linux ES release 3 (unpatched). Thanks
to Nico Morrison
- Added a 'mail-on-warning' option to the configuration file. When the checker finds
one or more warnings, it will send a warning to the system administrator (see the
configuration file for more information)
- Added 'tmpdir' option to the configuration. This optional value can be used instead
of the default (/usr/local/rkhunter/tmp) directory and is one of the first steps
to make rkhunter less static.
- Rootkit Hunter now exists with an exit code of 1 when a rootkit is found or
a MD5 checksum failed. Suggested by Michael Niehren
Changes:
- Updated support for Red Hat Enterprise Linux. Thanks to Nico Morrison
- Improved/updated .spec file for RPM creation (improved cronjob script, updated
file version, corrected packager value). Thanks to Joe Klemmer and Michael Niehren
- Improved cronjob check (it contained a little bug, so it wasn't always non-
interactive..)
- Improved logging of sockstat/netstat tests
- Fixed message when parameters are provided, but 'check' option is missing
- Updated installer (0.0.6)
--
* 1.0.4
New:
- Added 'AjaKit' (rootkit)
- Added 'Legion of Doom (LoD)' (rootkit) (note: uses almost every same file
as AjaKit)
- Added support for Red Hat Enterprise Linux. Thanks to Kevin Jarnot
Changes:
- Updated 'NSDAP' (rootkit)
- Updated 'Dica' (rootkit)
- Updated 'X-Org SunOS Rootkit' (rootkit)
- Changed message 'not found' into 'OK' when no file redirection has been found.
Thanks to Jens Gutzeit
- Improved check for hidden files (empty files will be skipped, more directories
added)
- Corrected file scan counter.
- Improved logging
- Cleaned up tarball
--
* 1.0.3
New:
- Added support for SuSE Linux 8.1.
Changes:
- Updated 'Flea Linux Rootkit', because /lib/security is a legal path name.
Thanks to Moritz Bunkus
- Updated syslog-ng checking (checking remote logging in the configuration file).
Thanks to Juri Memmert for reporting the problem
--
* 1.0.2
New:
- Added 'aPa Kit' (rootkit)
- Added 'Danny-Boy's Abuse Kit' (rootkit)
- Added 'Duarawkz' (rootkit)
- Added 'Flea Linux Rootkit' (rootkit)
- Added 'HjC kit' (rootkit)
- Added 'Kitko' (rootkit)
- Added 'R3dstorm Toolkit' (rootkit)
- Added 'TeLeKiT' (rootkit)
- Added 'VcKit' (rootkit)
- Added support for Aurora Linux 1.0 (SPARC, named 'Ansel')
- Added support for Red Hat Linux 7.0
- Added support for Mac OS X (Darwin kernel)
- Added option '--report-mode' to remove footer and location of logfile
- Added alias parameter '--createlog' for '--createlogfile'
- Added alias parameter '--skipkeypress' for '--skip-keypress'
- Added informational message when a user doesn't use '--checkall' or '--cronjob'
Changes:
- Updated hashes for Fedora Core 1. Thanks to Doncho N. Gunchev
- Improved output of logfile
- Changed warning message when a part of a rootkit has been found (show correct
logfile instead of default file)
- Changed footer message (and tell you guys you have to submit your undetected
rootkits)
Website:
- Updated articles: Hyperlinks, Scanning Techniques
--
* 1.0.1
New:
- Added parameter '-h' (or --help, -?) to display the usage syntax (same thing
when you give no options at all). Reported by Arthur E. Groen
- Support for Linux SuSE 8.2 (i586 platform)
Changes:
- Improved scan for 'Suckit' (rootkit)
- Updates hashes for Mandrake 9.2
- Fixed a problem with the installer (wrong function declaration).
- Had to strip down all colors in the installer, because of the complaints :-)
- Changed installer so it could be used as a non-interactive installer (like it
was before).. Languages are still usuable, but will be used in later versions
(with a interactive switch)
- Fixed the LANG function (renamed it, because of the reserved name).
- Added Swedish translation for the installer. Thanks to Daniel Olsson
- Improved logging when Perl has been found
- Undo 'skip MD5 test' (MD5CHECK_SKIP=0) when Digest::MD5 available, but
md5(sum) isn't, so we can still scanning.
- Fixed a wrong path name (deleting of temporary passwd file)
Website / Documentation:
- Updated FAQ
- Updated Project information (updated supported OSes, rootkits, added date of
last modification)
- Updated README
--
* 1.0.0
Special remarks:
- New developer: Stephane Dudzinski (a.k.a. FRLinux)
New:
* Operating system support
- Added support for Fedora (tested with Core 1, Yarrow)
- Added support for Gentoo (tested with 1.4 release)
- Added support for Red Hat 7.3 (Valhalla)
- Added support for Sun Solaris (not working yet..)
- Added OpenBSD 3.3 (i386) hashes
- Added Fedora Core 1 (i386) hashes
- Added special verify section when prelinked binaries are found (like Fedora
Core 1 uses). Thanks to Michael G. Rozman
- Added support for IBM AIX. A big thanks to Iain Roberts!
Versions 4.3.2, 4.3.3, 5.1, 5.2, 5.3, 5.4
* Rootkit / backdoor support
- Added 'Dreams' (rootkit). Thanks to Joshua Levitsky
- Added 'Heroin' (LKM rootkit)
- Added 'Sin' (rootkit)
- Added 'Shutdown' (rootkit)
- Added 'Sneakin' (rootkit)
- Added 'Superkit' (rootkit)
- Added 'T0rn' (rootkit)
- Added 'Trojanit Kit' (rootkit)
- Added 'zaRwT.KiT' (rootkit)
- Added 'Volc' (rootkit)
* Linux support
- Added extra kernel check (2.4/2.6) when OS is Linux
- Added Linux 2.6 kernel support.
- Added extra check when using a RPM based distro, to display the package name
in the logfile when filehashes are different. Thanks to Michael G. Rozman
* Rootkit Hunter options
- Added option '--quick'. Can be used with newly added scans and will use
some tweaks to scan quicker (be carefull: can hide some usefull information
at first scan, i.e. hidden files with trojaned binaries)
- Added option '--skip-keypress'. Make rkhunter non-interactive, so you don't
have to press [enter] after every test. Requested by Michael G. Rozman
- Added option '--version'. Displays version and quits.
- Added extra check for promiscuous interfaces, when 'ip' command is available
- Added check for (rootdir)etc/conf.d/local.start file (Gentoo)
- Added ksyms check to rootkitscan section
- Added check for binaries like nmap, ls, lsof, ps (for future use)
- Added Perl Digest::SHA1 module check
- Added SSH 'PermitRootLogin without-password' (as an unsafe option). Thanks
to Doncho
- Added check for sniffer logfiles detection
- Added support for grsec enabled Linux kernel. Thanks Steph ;-)
Changes:
- Improved installation
- Splitted version number (from 1.00 --> 1.0.0) due future minor releases
- Updated 'Ambient'
- Updated 'BOBkit'
- Updated 'Knark'
- Updated 'Sebek'
- Updated hashes for Red Hat 7.1 (fileutils, util-linux, SysVinit and xinetd).
Thanks to Michael G. Rozman
- Updated hashes for Debian 3.0 (IPv6 enabled version of tcpd). Thanks to Steph
- Changed LKM check when kernelversion of Linux is the new 2.6
- Improved support for other rootdirs (instead of '/')
- Added check for empty files when searching for hidden files
- Added check for real device fiels when searching for hidden files
- Added colored layout, when performing file checks (for i.e. hidden files)
- Little bugfix when perform LKM checking
- Bugfix when scanning sshd_config for file if file isn't available in /etc/ssh
- Improved logging for selftests
- Improved logging when performing MD5 hash test
- Improved logging for scanning of rootkits and malware
- Improved logging of rootkitscan section (files and directories)
- Improved logging for detection of binaries and Perl modules
- Improved SSH 'root login allowed', to decrease false positives
- Changed detection of users with an UID of 0 (zero)
- Improved rootkitscan section for files and directories with spaces
- Fixed wrong detection of Debian version (unstable/testing). Thanks to Daniel
Olsson
- Fixed wrong use of parameters when using --quick option, but not using -c.
Thanks to Joost Peters
- Added missing 'full OS' string, when RH doesn't recognise the operating
system.
- Fixed bad logging of rootkits (and files)
- Fixed a problem when using --skip-keypress and a rootkit was found (skip
keypress didn't work, and user input was required).
- Fixed installer for NetBSD and MacOS X, by commenting whereis functions (will
be soon replaced)
- A lot of code cleanups..
Website:
- Updated website (FAQ / Changelog, Project information)
- Fixed a problem with the contact form (-moz-opacity CSS property failed with
some browsers).
--
* 1.00 RC3
New:
- Added option --disable-md5-check to skip checking MD5 hashes (if you run
customized binaries/tools)
- Added option --rootdir (or -r), to use with chrooted systems. Note: not
completely integrated yet. Requested by Henk Wevers
- Added functions logtext and displaytext to make script more powerfull and
easier to use (for example with a new 'quiet' option)
- Added support for OpenBSD 3.3 and OpenBSD 3.4 (MD5 fix added, due the
missing of the -q (quiet) option of MD5). Thanks to Stefan
Changes:
- Updated 'Beastkit'
- Updated 'BOBkit'
- Updated hashes for Red Hat 9.0 (coreutils update). Thanks to Andrew Matthews
- Fixed a little problem with support for multiple file hashes (see 1.00 RC2).
When more than one hash was available, only the first one was checked. Thanks
to Andrew Matthews for testing.
- Solved two little issues with netstat check. Check reported possible backdoor
if portnumber was present in another portnumber (like string '2001' is
available in '20010'). Also the portnumber was found when the remote connection
had the same portnumber as a possible backdoor (like a dynamic port 2001 was
assigned to a SSH client). Thanks to Michael Firkins
- Changed text when a possible backdoored file is found (because --debug option
is not a valid). Thanks to Anton Pirnat
- Changed check for OpenSSH sshd_config file (it will search now for more than
1 place). Thanks to Jeroen Griede
- Added extra check for file retrieval utilities (i.e. to do version checking)
- Changed string at beginning of RH output (Determing OS... Ready)
- Made some tweaks to the layout of the logfile (with --createlogfile option)
--
* 1.00 RC2
New:
- Added check for syslog-ng (instead of only checking for the presence of
syslogd). Thanks to Chris Vaughan
- Added check to allow more than one MD5/SHA1 for a single file. When a 'base'
file will be updated, it's possible to add a second hash. Thanks to
James Clark and Greg Bell
- Added AIX check. Thanks to Val Baranov
- Added hashes for SuSE 8.2 (i386)
- Added hashes for Red Hat 9.0
- Added hashes for Mandrake 9.2
- Added hashes for Debian 3.0 (tested with release 2)
- Added support for Mandrake (i.e. /dev/.devfsd file)
- Added section to check the file type of every hidden file found
- Added parameter 'nocolors' to disable colored output
- Added support to run RH as a cronjob (parameter '--cronjob')
- Added check to removed layout when running as cronjob
- Added option to create a logfile (parameter '--createlogfile')
- Added changelog on website (rootkit.nl)
Changes:
- Updated hashes for Red Hat 7.2
- Cleanup logfile at startup
- Just check /dev directory once for hidden files
- Deleted unused consistency check (on Debian it showed several warnings)
- Fixed a little problem with querying the default hashes database (added a
slash to the query, to resolve the problem)
- Layout fix for Linux distros
- Fixed an error for Debian (where /etc/rc.d files not always exists..) by
adding an extra check for the presence of this files.
- Tweaked section to scan /dev directory. Scan is faster now (scan for
unknown shellscripts and files)
- Some little layout changes
- Updated 'Beastkit' due false positive. Thanks to Dunay
- Updated 'Suckit' (more checks added)
- Changed FAQ
--
* 1.00 RC1
Remarks:
First release
New:
- Database: backdoor ports (DB:backdoorports.dat)
- Added filtering for network connections
- Added OS support for SuSE Linux:
- Added OS support for Debian: 2.2/3.0/testing
- Added OS support for FreeBSD 5.x: version 5.0/5.1
- Added OS support for FreeBSD 4.x: version 4.3/4.7
- Added OS support for Red Hat Linux 7.1/7.2
- Added KLD tests (FreeBSD)
- All other options...