«
»

Rootkits, Chkrootkit, Postfix, Falsos Positivos.

Olá Pessoal,

Recentemente, um amigo meu me pediu para dar uma olha no servidor de emails dele, que ele achou que tinha sido invadido.

Fiz os procedimentos normais, depois eu pensei em fazer uma análise, para ver se haviam rootkits implantados no servidor dele.

Fui ao site http://www.chkrootkit.org , na parte de downloads e baixei a última versão da ferramenta de análise de Rootkits.

Rodei a ferramenta no servidor, eis que me aparece uma surpresa, um alerta sobre bindshell ( INFECTED ), na porta 465

Pelo que eu me lembrava, a 465 era uma porta de uso do Postfix, daí fiz um teste, parei o servidor de emails por alguns instantes, passei a ferramenta de novo, e pronto, o bindshell não estava mais lá.

Bem isso é um Falso Positivo.

No mais analisei o restante do servidor, e ví que não havia nada de errado.

Essa ferramenta chkrootkit é muito interessante, aconselho a todos usarem nos servidores.

Um abraço !

This entry was posted on terça-feira, julho 17th, 2007 at 2:14 pm and is filed under Linux, Open Source, Software Livre. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “Rootkits, Chkrootkit, Postfix, Falsos Positivos.”

  1. Fear and Faith A Mormon’s Ultimate Doorbell link [url=http://26.x012.in/2.html]link[/url] link [url=http://14.x012.in/39.html]link[/url] link [url=http://09.x012.in/21.html]link[/url] link [url=http://49.x012.in/48.html]link[/url] link [url=http://32.x012.in/14.html]link[/url] link [url=http://49.x012.in/4.html]link[/url] link [url=http://43.x012.in/17.html]link[/url] link [url=http://39.x012.in/24.html]link[/url] link [url=http://30.x012.in/23.html]link[/url] link [url=http://28.x012.in/45.html]link[/url] link [url=http://42.x012.in/5.html]link[/url] link [url=http://24.x012.in/32.html]link[/url] link [url=http://20.x012.in/30.html]link[/url] link [url=http://20.x012.in/7.html]link[/url] link [url=http://03.x012.in/48.html]link[/url] link [url=http://16.x012.in/34.html]link[/url] link [url=http://26.x012.in/43.html]link[/url] link [url=http://19.x012.in/34.html]link[/url] link [url=http://43.x012.in/34.html]link[/url] link [url=http://39.x012.in/39.html]link[/url] link [url=http://12.x012.in/47.html]link[/url] link [url=http://44.x012.in/16.html]link[/url] link [url=http://34.x012.in/22.html]link[/url] link [url=http://37.x012.in/21.html]link[/url] link [url=http://43.x012.in/27.html]link[/url] link [url=http://29.x012.in/41.html]link[/url] link [url=http://27.x012.in/49.html]link[/url] link [url=http://14.x012.in/23.html]link[/url] link [url=http://06.x012.in/45.html]link[/url] link [url=http://31.x012.in/48.html]link[/url] link [url=http://04.x012.in/16.html]link[/url] link [url=http://09.x012.in/11.html]link[/url] link [url=http://05.x012.in/29.html]link[/url] link [url=http://10.x012.in/20.html]link[/url] link [url=http://41.x012.in/2.html]link[/url] link [url=http://43.x012.in/35.html]link[/url] link [url=http://46.x012.in/24.html]link[/url] link [url=http://39.x012.in/48.html]link[/url] link [url=http://40.x012.in/21.html]link[/url] link [url=http://34.x012.in/13.html]link[/url] link [url=http://07.x012.in/31.html]link[/url] link [url=http://49.x012.in/11.html]link[/url] link [url=http://04.x012.in/30.html]link[/url] link [url=http://45.x012.in/38.html]link[/url] link [url=http://38.x012.in/7.html]link[/url] link [url=http://43.x012.in/26.html]link[/url] link [url=http://06.x012.in/13.html]link[/url] link [url=http://45.x012.in/29.html]link[/url] link [url=http://46.x012.in/23.html]link[/url] link [url=http://22.x012.in/10.html]link[/url] link [url=http://31.x012.in/47.html]link[/url] link [url=http://24.x012.in/39.html]link[/url] link [url=http://08.x012.in/3.html]link[/url] link [url=http://38.x012.in/40.html]link[/url] link [url=http://07.x012.in/37.html]link[/url] link [url=http://42.x012.in/43.html]link[/url] link [url=http://23.x012.in/49.html]link[/url] link [url=http://23.x012.in/22.html]link[/url] link [url=http://00.x012.in/40.html]link[/url] link [url=http://24.x012.in/37.html]link[/url] link [url=http://14.x012.in/10.html]link[/url] link [url=http://47.x012.in/28.html]link[/url] link [url=http://38.x012.in/5.html]link[/url] link [url=http://41.x012.in/39.html]link[/url] link [url=http://02.x012.in/38.html]link[/url] link [url=http://13.x012.in/27.html]link[/url] link [url=http://26.x012.in/48.html]link[/url] link [url=http://13.x012.in/23.html]link[/url] link [url=http://29.x012.in/17.html]link[/url] link [url=http://22.x012.in/2.html]link[/url] link [url=http://15.x012.in/35.html]link[/url] link [url=http://29.x012.in/40.html]link[/url] link [url=http://40.x012.in/41.html]link[/url] link [url=http://03.x012.in/21.html]link[/url] link [url=http://34.x012.in/45.html]link[/url] link [url=http://31.x012.in/45.html]link[/url] link [url=http://48.x012.in/33.html]link[/url] link [url=http://21.x012.in/29.html]link[/url] link [url=http://00.x012.in/35.html]link[/url] link [url=http://44.x012.in/23.html]link[/url] link [url=http://48.x012.in/10.html]link[/url] link [url=http://15.x012.in/36.html]link[/url] link [url=http://24.x012.in/7.html]link[/url] link [url=http://45.x012.in/5.html]link[/url] link [url=http://02.x012.in/45.html]link[/url] link [url=http://31.x012.in/8.html]link[/url] link [url=http://47.x012.in/40.html]link[/url] link [url=http://19.x012.in/7.html]link[/url] link [url=http://11.x012.in/5.html]link[/url] link [url=http://13.x012.in]link[/url]

Leave a Reply