kernel.org status: hints on how to check your machine for intrusion [LWN.net]

kernel.org status: hints on how to check your machine for intrusion

Posted Oct 5, 2011 17:22 UTC (Wed) by nls (guest, #80623)
In reply to: kernel.org status: hints on how to check your machine for intrusion by nls
Parent article: kernel.org status: hints on how to check your machine for intrusion

I did a fresh install of FC15 on another system. I installed chkrootkit. I rebooted. I ran chkrootkit. I got one wted message "5 deletion(s)". It appears during shutdown wtmp is being corrupted.

Checking `wted'... 5 deletion(s) between Wed Oct 5 12:43:57 2011 and Wed Oct 5 12:44:09 2011

[admin@opusrex ~]$ su -c "grep rsyslogd /var/log/messages | grep exiting"
Password:
Oct 5 12:44:06 opusrex rsyslogd: [origin software="rsyslogd" swVersion="5.8.5" x-pid="1023" x-info="http://www.rsyslog.com"] exiting on signal 15.

I will report bug to Fedora.

(Log in to post comments)

kernel.org status: hints on how to check your machine for intrusion

Posted Oct 6, 2011 9:46 UTC (Thu) by jwakely (subscriber, #60262) [Link]

I get dozens of "wted deletions" with chkrootkit on F15, which all coincide with shutting down. I also get a warning about X running without an entry in utmp. I was considering reporting it to bugzilla too, but I'll CC myself on your bugzilla report