chkrootkit output - Security

This is a discussion on chkrootkit output - Security ; I get the following output from chkrootkit: Checking `chkutmp'... The tty of the following user process(es) were not found in /var/run/utmp ! ! RUID PID TTY CMD ! root 3186 tty7 /usr/bin/Xorg :0 -br -audit 0 -auth /var/gdm/:0.Xauth -nolisten tcp ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: chkrootkit output

  1. chkrootkit output

    I get the following output from chkrootkit:

    Checking `chkutmp'... The tty of the following user process(es) were not found
    in /var/run/utmp !
    ! RUID PID TTY CMD
    ! root 3186 tty7 /usr/bin/Xorg :0 -br -audit 0 -auth /var/gdm/:0.Xauth -nolisten tcp vt7
    chkutmp: nothing deleted

    I don't understand the meaning of this message. This just looks like the X-server
    process. Can someone please clarify?
    --
    % Randy Yates % "Watching all the days go by...
    %% Fuquay-Varina, NC % Who are you and who am I?"
    %%% 919-577-9882 % 'Mission (A World Record)',
    %%%% % *A New World Record*, ELO
    http://home.earthlink.net/~yatescr

  2. Re: chkrootkit output

    Bill Marcum writes:

    > On Thu, 16 Aug 2007 16:36:53 -0400, Germantown Mutt
    > wrote:
    >>
    >>
    >> I get the following output from chkrootkit:
    >>
    >> Checking `chkutmp'... The tty of the following user process(es) were not found
    >> in /var/run/utmp !
    >> ! RUID PID TTY CMD
    >> ! root 3186 tty7 /usr/bin/Xorg :0 -br -audit 0 -auth /var/gdm/:0.Xauth -nolisten tcp vt7
    >> chkutmp: nothing deleted
    >>
    >> I don't understand the meaning of this message. This just looks like
    >> the X-server process. Can someone please clarify?

    >
    > It looks like an ordinary X server process. What linux distribution and
    > version of chkrootkit do you have?


    Linux localhost.localdomain 2.6.20-1.2948.fc6 #1 SMP Fri Apr 27 19:18:54 EDT 2007 x86_64 x86_64 x86_64 GNU/Linux
    chkrootkit version 0.47
    --
    % Randy Yates % "Maybe one day I'll feel her cold embrace,
    %% Fuquay-Varina, NC % and kiss her interface,
    %%% 919-577-9882 % til then, I'll leave her alone."
    %%%% % 'Yours Truly, 2095', *Time*, ELO
    http://home.earthlink.net/~yatescr

+ Reply to Thread