On 10/05/2022 05:37, Vitaly Krasheninnikov wrote:
Thank you for debcheckroot. I think it is a great project, which makes us one
step closer to a verifiable Debian system.
In this particular case, I'd like to point out the exact flags from fileserror.lis that you showed
us: "..._.GM" and "..._..M".
According to the description on your website, it means the modification of the
file permissions, not the actual content.
Thanks a lot for clarifying this. I found the interpretation of the
results of debcheckroot at https://www.elstel.org/debcheckroot/
On 06/05/2022 15:52, Elmar Stellnberger wrote:
Am 06.05.22 um 15:05 schrieb Sylvain Sécherre:
> Here's the fileserror.lis:
> ..._.GM /usr/bin/crontab cron_3.0pl1-137_amd64 root root 755
> ..._..M /usr/bin/pkexec policykit-1_0.105-31+deb11u1_amd64 root root
755
> ..._.GM /usr/bin/ssh-agent openssh-client_1:8.4p1-5_amd64 root root 755
> ...
I hope you won´t mind that I am citing the output of debcheckroot
you have given me.
These three files point to an infection with a rootkit. Don´t care
about modified configuration files like in /etc too much (but you may
still have a look at them). Executable files on the other hand must
never be modified. If these three files are different it means that
someone has altered your system. If you look at the man pages of these
executables then you also know that a maker of a rootkit would have
interest to modify exactly these files.
Since you are the author of the debcheckroot tool, why do you think that
the G (group) and M (mode) flags indicate the content of the files were
altered? Or did you make a mistake and forgot what the output of
debcheckroot actually means? If so, does this change your opinion that a
rootkit is installed on this system?
Kind regards,
Richard
