The rkhunter developer has finally released a long awaited update:
- This release added support for RHEL WS/AS/ES 3 Taroon update 8, Fedora Core 5, and SuSE 10. Checks were added for packet capturing applications and processes using deleted files. The netstat check was enabled for AIX and the backdoor check was enabled for SunOS. Logfile specification and checks were added.
http://rkhunter.sourceforge.net/Unfortunately, it looks like they still don’t support the most popular OS’s md5sums, i.e. RHEv4/CentOSv4To upgrade:
/bin/rm -Rf rkhunter*wget http://surfnet.dl.sourceforge.net/sourceforge/rkhunter/rkhunter-1.2.9.tar.gztar -xzf rkhunter-*cd rkhunter-*./installer.sh cd ../bin/rm -Rf rkhunter*rkhunter –updaterkhunter -c –skip-keypress
A major security flaw has been found and is being actively exploited in cPanel. The exploit gives an authenticated user (i.e. someone who has access to a cPanel account) an escalation that gives them root access. cPanel have fixed the hole and most people will have been secured overnight. To be sure I would suggest everyone runs a forced upcp update on their servers: