The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

RKhunter Report Assistance

Discussion in 'Security' started by furquan, Jul 5, 2017.

  1. furquan

    furquan Well-Known Member

    Joined:
    Jul 27, 2002
    Messages:
    461
    Likes Received:
    3
    Trophy Points:
    168
    Hello Everyone,

    I have received RKhunter report from my server, saying to inspect it, Can anybody on board, Please view my log file and suggest a recourse ,


    Code:
    Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/letsencrypt-cpanel/a9b30a69632884ea8563715899da72bbe29e9dc14861e56c8a795eea9530762f-primary.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/letsencrypt-cpanel/303fe8cf5695c872b496cda0432da7dbf333084b7e4d4136ba6876ffbe857c92-primary.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/letsencrypt-cpanel/522618658edb679fbe08f90154ebb2f41b70fbcfd59ec6666f0f0ab0f4a54aa4-primary.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/letsencrypt-cpanel/340453fda5b7faedeaf5b2aba2d108a512ff129372624c1b32dbd7acc0153faa-primary.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/letsencrypt-cpanel/46c97d0c02afab94a1edfde0edc191f2e3a69189dec570346a1e88e7ea520aa8-primary.sqlite' (score: 220) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/timedhosts.txt' (score: 230) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/zabbix/primary.xml.gz.sqlite' (score: 250) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/vz-base/primary.xml.gz.sqlite' (score: 230) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/updates/f9ba18b824d0117a2d8811623a6e972c532602e517b835980e467aefb656f590-primary.sqlite' (score: 280) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/cpanel-addons-production-feed/493c84f52de21f15742d217e16d7223a725b8d0c1371d4ef12acdce5b56764be-primary.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/cpanel-addons-production-feed/f246a240bc566ed671fc1bb3b0a83cb781584ca2c12bc521a5c3f12f6aeab788-primary.sqlite' (score: 230) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/cpanel-addons-production-feed/96ad31befdebee545a8b804c9bd82a99a1bb503ab42a86ee39be612e48af962c-primary.sqlite' (score: 240) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/cpanel-addons-production-feed/133dd024d245f8744bd4f9dbf00d2fda0323dd8014ffa26342a345100c7913d1-primary.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/vz-updates/primary.xml.gz.sqlite' (score: 230) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/extras/10ad16f4d694631e494de50f922f67b655e509ea9641477c354e340c48d03cbc-primary.sqlite' (score: 241) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/extras/1b43133bfe09067a4816563f80792c23ae179d4652ba74dad71372d315a9632d-primary.sqlite' (score: 251) contains some suspicious content and should be checked.
Warning: File '/var/tmp/yum-zabbix-FmPFhh/x86_64/6/zabbix-non-supported/primary.xml.gz.sqlite' (score: 210) contains some suspicious content and should be checked.
Warning: Checking for files with suspicious contents [ Warning ]
Warning: No output found from the lsmod command or the /proc/modules file:
         /proc/modules output:
         lsmod output:
Warning: The SSH and rkhunter configuration options should be the same:
         SSH configuration option 'PermitRootLogin': without-password
         Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no
Warning: Suspicious file types found in /dev:
         /dev/.udev/queue.bin: data
Warning: Hidden directory found: /dev/.udev
Warning: Hidden file found: /usr/share/man/man5/.k5identity.5.gz: gzip compressed data, from Unix, max compression
Warning: Hidden file found: /usr/share/man/man5/.k5login.5.gz: gzip compressed data, from Unix, max compression
Warning: Hidden file found: /usr/share/man/man1/..1.gz: gzip compressed data, from Unix, max compression
Warning: Hidden file found: /usr/bin/.ssh.hmac: ASCII text
Warning: Hidden file found: /usr/bin/.fipscheck.hmac: ASCII text
Warning: Hidden file found: /usr/sbin/.sshd.hmac: ASCII text
Warning: Application 'openssl', version '1.0.1e', is out of date, and possibly a security risk.
    Thank you,
     
    #1 furquan, Jul 5, 2017
    Last edited by a moderator: Jul 5, 2017
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,022
    Likes Received:
    1,276
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    It's very possible the alerts in the output you provided are false positives, however it's difficult to provide specific security advice without access to the affected system. Have you reviewed the files listed in your output to see if anything within the files look suspicious? You can find a list of qualified system administrators on the following URL if you'd like help with a full security scan of your system:

    System Administration Services | cPanel Forums

    Thank you.
     
    #2 cPanelMichael, Jul 5, 2017
  3. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    982
    Likes Received:
    75
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    I agree with Michael, most likely these are false positives. Unless you have other reason to believe the system is compromised you are likely OK, but if you have doubts then you should have a sysadmin poke around.
     
    #3 quizknows, Jul 5, 2017
  4. furquan

    furquan Well-Known Member

    Joined:
    Jul 27, 2002
    Messages:
    461
    Likes Received:
    3
    Trophy Points:
    168
    Thank you Michael and Quizknows for your wise words :)
     
    #4 furquan, Jul 5, 2017
(You must log in or sign up to post here.)
Loading...
Similar Threads - RKhunter Report Assistance
  1. schatzman

    SOLVED Installing RKhunter issue

    schatzman, May 25, 2017, in forum: Security
    Replies:
    9
    Views:
    238
    cPanelMichael
    Jun 1, 2017
  2. bloatedstoat

    rkhunter: VAX-order 68K Blit (standalone) executable

    bloatedstoat, Oct 19, 2015, in forum: Security
    Replies:
    3
    Views:
    504
    cPanelMichael
    Nov 9, 2015
  3. CBG

    Strange email - cpaddons_report

    CBG, Aug 9, 2017, in forum: General Discussion
    Replies:
    1
    Views:
    54
    Infopro
    Aug 9, 2017
  4. Mihaigogo

    Mail delivery report after sent email?

    Mihaigogo, Aug 4, 2017, in forum: E-mail Discussions
    Replies:
    1
    Views:
    60
    cPanelMichael
    Aug 4, 2017
  5. Lathanael

    SOLVED Strange Cron email from cpaddons_report.pl

    Lathanael, Jul 31, 2017, in forum: E-mail Discussions
    Replies:
    11
    Views:
    229
    Lathanael
    Aug 12, 2017 at 7:46 AM

Share This Page