Rootkit

[Rick Stevens]

On Tue, 2007-10-23 at 17:00 -0600, Karl Larsen wrote:
>     Reading about Rootkit got me interested in chkrootkit so I d/l it 
> and ran it with -p which is quiet and it finished with this:
> 
> [root at k5di ~]# chkrootkit -q
> eth0: PF_PACKET(/sbin/dhclient)
>  The tty of the following user process(es) were not found
>  in /var/run/utmp !
> ! RUID          PID TTY    CMD
> ! root         2962 tty7   /usr/bin/Xorg :0 -br -audit 0 -auth 
> /var/gdm/:0.Xauth -nolisten tcp vt7
> [root at k5di ~]#
> 
> I am confused by this output. Does anyone know what this is and what I 
> should do with it?

Ignore it.  When gdm fires up and takes over tty7 it doesn't put an
entry in utmp.  That's fairly minor.  However, it's best to run
chkrootkit in a non-GUI runstate (e.g. runstate 3).  One way to do it
is:

	1. Log out of the GUI
	2. Press CTRL-ALT-F1 to get to a regular console
	3. Log in as root
	4. # telinit 3
	5. # chkrootkit -q
	6. # telinit 5
	7. Log back into the GUI

----------------------------------------------------------------------
- Rick Stevens, Principal Engineer             rstevens at internap.com -
- CDN Systems, Internap, Inc.                http://www.internap.com -
-                                                                    -
-  You know you've landed gear-up when it takes full power to taxi.  -
-                                                -- Chuck Yeager     -
----------------------------------------------------------------------