diff --git a/.gitignore b/.gitignore index 8ffe1c8..0486fc1 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,5 @@ rkhunter-1.3.6.tar.gz /rkhunter-1.3.8.tar.gz /rkhunter-1.4.0.tar.gz /rkhunter-1.4.2.tar.gz +/rkhunter-1.4.4.tar.gz +/rkhunter-1.4.6.tar.gz diff --git a/01-rkhunter b/01-rkhunter index 6ff8877..1e85c8e 100755 --- a/01-rkhunter +++ b/01-rkhunter @@ -19,7 +19,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then fi # If a diagnostic mode scan was requested, setup the parameters - if [ "$DIAG_SCAN" == "yes" ]; then + if [ "$DIAG_SCAN" = "yes" ]; then RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile" else RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only" diff --git a/rkhunter-1.4.6-drop-libkeyutils-check.patch b/rkhunter-1.4.6-drop-libkeyutils-check.patch new file mode 100644 index 0000000..b35ceaa --- /dev/null +++ b/rkhunter-1.4.6-drop-libkeyutils-check.patch @@ -0,0 +1,43 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2018-02-24 15:08:27.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-01-15 12:47:54.399665856 -0800 +@@ -8370,9 +8370,7 @@ + /lib/libsbr.so + /lib64/libsbr.so + /lib/libslr.so +- /lib64/libslr.so +- /lib/tls/libkeyutils.so.1 +- /lib64/tls/libkeyutils.so.1" ++ /lib64/libslr.so" + EBURY_DIRS= + EBURY_KSYMS= + +@@ -9762,10 +9760,6 @@ + file:/usr/share/sshd.sync:Trojaned SSH daemon + file:/bin/zcut:Trojaned SSH daemon + file:/usr/bin/zmuie:Trojaned SSH daemon +- file:/lib/libkeyutils.so.1.9:Sniffer component +- file:/lib64/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib64/libkeyutils.so.1.9:Sniffer component + file:/IptabLes:malware component + file:/.IptabLex:malware component + file:/boot/.IptabLex:malware component +@@ -9956,7 +9950,6 @@ + ssh-scan:Port scanner + atac:Port scanner component + \[pdflush\]:IRC bot +- libkeyutils.so.1.9:Spam tool component + .IptabLex:malware component + .IptabLes:malware component + .flush:malware component +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65 +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570 diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.6-epel7.patch similarity index 68% rename from rkhunter-1.4.2-fedoraconfig.patch rename to rkhunter-1.4.6-epel7.patch index d6e6f07..8fc498c 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.6-epel7.patch @@ -1,7 +1,13 @@ -diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf ---- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-02-23 19:38:01.000000000 -0700 -+++ rkhunter-1.4.2/files/rkhunter.conf 2014-03-05 17:23:47.171809385 -0700 -@@ -155,6 +155,7 @@ +diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf +--- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter.conf 2020-05-16 14:20:16.767707769 -0700 +@@ -1,4 +1,4 @@ +-# ++## + # This is the main configuration file for Rootkit Hunter. + # + # You can modify this file directly, or you can create a local configuration +@@ -158,6 +158,7 @@ # default directory beneath the installation directory. # #TMPDIR=/var/lib/rkhunter/tmp @@ -9,16 +15,15 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # This option specifies the database directory to use. -@@ -163,7 +164,7 @@ - # subsequently commented out or removed, then the program will assume a +@@ -167,6 +168,7 @@ # default directory beneath the installation directory. # --#DBDIR=/var/lib/rkhunter/db + #DBDIR=/var/lib/rkhunter/db +DBDIR=/var/lib/rkhunter/db # # This option specifies the script directory to use. -@@ -172,6 +173,7 @@ +@@ -175,6 +177,7 @@ # subsequently commented out or removed, then the program will not run. # #SCRIPTDIR=/usr/local/lib/rkhunter/scripts @@ -26,7 +31,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # This option can be used to modify the command directory list used by rkhunter -@@ -228,7 +230,7 @@ +@@ -231,7 +234,7 @@ # # The default value is '/var/log/rkhunter.log'. # @@ -35,7 +40,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Set this option to '1' if the log file is to be appended to whenever rkhunter -@@ -238,6 +240,7 @@ +@@ -241,6 +244,7 @@ # The default value is '0'. # #APPEND_LOG=0 @@ -43,7 +48,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Set the following option to '1' if the log file is to be copied when rkhunter -@@ -304,6 +307,7 @@ +@@ -307,6 +311,7 @@ # The default value is 'no'. # #ALLOW_SSH_ROOT_USER=no @@ -51,7 +56,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Set this option to '1' to allow the use of the SSH-1 protocol, but note -@@ -318,6 +322,7 @@ +@@ -321,6 +326,7 @@ # The default value is '0'. # #ALLOW_SSH_PROT_V1=0 @@ -59,17 +64,17 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # This setting tells rkhunter the directory containing the SSH configuration -@@ -350,7 +355,8 @@ +@@ -353,7 +359,8 @@ # program defaults. # ENABLE_TESTS=ALL --DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps -+#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps -+DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps +-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem # # The HASH_CMD option can be used to specify the command to use for the file -@@ -422,6 +428,7 @@ +@@ -435,6 +442,7 @@ # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options. # #PKGMGR=NONE @@ -77,17 +82,22 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # It is possible that a file, which is part of a package, may have been -@@ -545,6 +552,9 @@ +@@ -558,6 +566,14 @@ # The default value is the null string. # #EXISTWHITELIST="" +EXISTWHITELIST=/bin/ad +# FreeIPA Certificate Authority +EXISTWHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system ++# Some non default installed files we check ++EXISTWHITELIST=/usr/bin/GET ++EXISTWHITELIST=/usr/bin/whatis # # Whitelist various attributes of the specified file. The attributes are those -@@ -575,6 +585,12 @@ +@@ -588,6 +604,12 @@ # The default value is the null string. # #SCRIPTWHITELIST=/usr/bin/groups @@ -100,7 +110,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified file to have the immutable attribute set. -@@ -605,6 +621,19 @@ +@@ -630,6 +652,19 @@ #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.udevdb #ALLOWHIDDENDIR=/dev/.mdadm @@ -120,10 +130,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -620,6 +649,30 @@ +@@ -644,7 +679,33 @@ + #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac - #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac +-#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac ++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac +ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz" +ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac +ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac @@ -148,13 +160,26 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWHIDDENFILE=/etc/.etckeeper +ALLOWHIDDENFILE=/etc/.gitignore +ALLOWHIDDENFILE=/etc/.bzrignore ++# systemd ++ALLOWHIDDENFILE=/etc/.updated # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +734,16 @@ +@@ -714,6 +775,35 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* ++# Allow PCS/Pacemaker/Corosync ++ALLOWDEVFILE=/dev/shm/qb-attrd-* ++ALLOWDEVFILE=/dev/shm/qb-cfg-* ++ALLOWDEVFILE=/dev/shm/qb-cib_rw-* ++ALLOWDEVFILE=/dev/shm/qb-cib_shm-* ++ALLOWDEVFILE=/dev/shm/qb-corosync-* ++ALLOWDEVFILE=/dev/shm/qb-cpg-* ++ALLOWDEVFILE=/dev/shm/qb-lrmd-* ++ALLOWDEVFILE=/dev/shm/qb-pengine-* ++ALLOWDEVFILE=/dev/shm/qb-quorum-* ++ALLOWDEVFILE=/dev/shm/qb-stonith-* +ALLOWDEVFILE=/dev/shm/pulse-shm-* +ALLOWDEVFILE=/dev/md/md-device-map +# tomboy creates this one @@ -165,22 +190,35 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWDEVFILE="/dev/shm/spice.*" +# created by mdadm +ALLOWDEVFILE="/dev/md/autorebuild.pid" ++# 389 Directory Server ++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats ++# squid proxy ++ALLOWDEVFILE=/dev/shm/squid-cf* ++# squid ssl cache ++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm ++# Allow podman ++ALLOWDEVFILE=/dev/shm/libpod*lock* # - # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1067,9 @@ + # Allow the specified process pathnames to use shared memory segments. +@@ -1090,6 +1180,14 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" +RTKT_FILE_WHITELIST=/bin/ad +# FreeIPA Certificate Authority +RTKT_FILE_WHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system ++# FreeIPA with KRA (Password Vault) ++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1288,5 @@ +@@ -1329,3 +1427,5 @@ + # The default value is '0'. # - #EMPTY_LOGFILES="" - #MISSING_LOGFILES="" + #GLOBSTAR=0 + +INSTALLDIR="/usr" diff --git a/rkhunter.spec b/rkhunter.spec index f322617..c83b90e 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -2,8 +2,8 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Name: rkhunter -Version: 1.4.2 -Release: 1%{?dist} +Version: 1.4.6 +Release: 3%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -12,7 +12,8 @@ URL: http://rkhunter.sourceforge.net/ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz Source2: 01-rkhunter Source3: rkhunter.sysconfig -Patch0: rkhunter-1.4.2-fedoraconfig.patch +Patch0: rkhunter-1.4.6-epel7.patch +Patch1: rkhunter-1.4.6-drop-libkeyutils-check.patch BuildArch: noarch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -28,9 +29,7 @@ and other unwanted tools. %prep -%setup -q - -%patch0 -p1 +%autosetup -p1 %{__cat} <<'EOF' >%{name}.logrotate %{_localstatedir}/log/%{name}/%{name}.log { @@ -51,6 +50,7 @@ EOF %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8 +%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n @@ -99,6 +99,51 @@ EOF %{_mandir}/man8/* %changelog +* Tue May 04 2021 Kevin Fenzi - 1.4.6-3 +- Add patch to fix false positive for libkeyutils + +* Sat May 16 2020 Kevin Fenzi - 1.4.6-2 +- Add allow for podman's /dev/shm files (fixes bug #1828698 ) + +* Sun Feb 25 2018 Kevin Fenzi - 1.4.6-1 +- Upgrade to 1.4.6. Fixes bug #1524456 +- Allow KRA vault log files. Fixes bug #1541472 +- ipc_shared_mem warning fixed upstream. Fixes bug #1524456 + +* Sat Aug 12 2017 Kevin Fenzi - 1.4.4-3 +- Disable ipc_shared_mem test for now due to false positives. Bug #1472299 + +* Mon Jul 03 2017 Kevin Fenzi - 1.4.4-2 +- Correct some rebasing errors on config. + +* Fri Jun 30 2017 Kevin Fenzi - 1.4.4-1 +- Update to 1.4.4. Fixes bug #1466318 +- Fix for logger and spaces. Fixes bug #1284403 + +* Wed Jan 25 2017 Mukundan Ragavan - 1.4.2-8 +- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602 +- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130 + +* Tue Jan 05 2016 Mukundan Ragavan - 1.4.2-7 +- Fix ssh config value in patch + +* Thu Dec 31 2015 Mukundan Ragavan - 1.4.2-6 +- Allow /etc/.updated on EL7 +- Fixes bug#1291629 + +* Mon Oct 27 2014 Kevin Fenzi 1.4.2-5 +- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428 + +* Fri Sep 26 2014 Kevin Fenzi 1.4.2-4 +- Fix cron script to work with non bash shells. Fixes bug #1146717 + +* Sun Jun 08 2014 Fedora Release Engineering - 1.4.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sun Apr 06 2014 Kevin Fenzi 1.4.2-2 +- Add patch to fix ipcs command in non en locales +- Add config to fix freeipa installs. Fixes bug #994567 + * Fri Mar 14 2014 Kevin Fenzi 1.4.2-1 - Update to 1.4.2 @@ -289,7 +334,7 @@ EOF - Changed to SHA1 for optional message digest (canary check) - Added a couple of suggested skip entries to rkhunter.conf -* Mon Jun 11 2005 Greg Houlette - 1.2.7-1 +* Sat Jun 11 2005 Greg Houlette - 1.2.7-1 - Added signature auto-updating to CRON scan (new script) - Removed BOOTSCAN pending rewrite to full SysV Init scan in background - Added the --append-log command line option diff --git a/sources b/sources index 873ec5b..956755f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -85ad366b7f3999eb2a9371e39a1a4df7 rkhunter-1.4.2.tar.gz +SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216