Re: [Rkhunter-users] 1.4.2 issue

2014-03-11 Thread John Horne
On Mon, 2014-03-10 at 12:17 -0600, Kevin Fenzi wrote: Greetings. Fedora rkhunter package maintainer here... I'm looking at pushing 1.4.2 out soon, but I have at least one user seeing a problem with it: From: https://bugzilla.redhat.com/show_bug.cgi?id=1071547 [root@srv-rhsoft:~]$ rpm

Re: [Rkhunter-users] 1.4.2 issue

2014-03-11 Thread Kevin Fenzi
On Tue, 11 Mar 2014 10:09:08 + John Horne john.ho...@plymouth.ac.uk wrote: On Mon, 2014-03-10 at 12:17 -0600, Kevin Fenzi wrote: Greetings. Fedora rkhunter package maintainer here... I'm looking at pushing 1.4.2 out soon, but I have at least one user seeing a problem with it:

Re: [Rkhunter-users] Trojaned SSHD

2014-03-11 Thread John Horne
On Tue, 2014-03-11 at 10:34 -0500, Wally wrote: Greetings. I've recently installed openssh 6.5p1, openssl 1.0.1f and rkhunter 1.4.2. Rkunter issues the following warning: Warning: Checking for possible rootkit strings[ Warning ]Found string 'aion' in file '/usr/sbin/sshd'.

Re: [Rkhunter-users] Trojaned SSHD

2014-03-11 Thread Tanstaafl
On 3/11/2014 11:34 AM, Wally wnow...@gmail.com wrote: Warning: Checking for possible rootkit strings[ Warning ]Found string 'aion' in file '/usr/sbin/sshd'. Possible rootkit: Trojaned SSH daemon $ strings sshd | grep aion Vector Permutaion AES for x86_64/SSSE3, Mike Hamburg (Stanford

Re: [Rkhunter-users] Trojaned SSHD

2014-03-11 Thread Wally
It certainly looks like a typo. I'll let the folks from openssl know and recompile. If I whitelist sshd, will rkhunter always ignore sshd or just the current state of sshd? On Tue, Mar 11, 2014 at 12:44 PM, Tanstaafl tansta...@libertytrek.orgwrote: On 3/11/2014 11:34 AM, Wally

Re: [Rkhunter-users] 1.4.2 issue

2014-03-11 Thread John Horne
On Tue, 2014-03-11 at 08:36 -0600, Kevin Fenzi wrote: On Tue, 11 Mar 2014 10:09:08 + John Horne john.ho...@plymouth.ac.uk wrote: On Mon, 2014-03-10 at 12:17 -0600, Kevin Fenzi wrote: Greetings. Fedora rkhunter package maintainer here... I'm looking at pushing 1.4.2 out soon,