Help Me Prevent A Linux Server Reboot

I was having trouble running something I heard about called chkrootkit.
You download this file, expand and compile it, and then run a Bash
script. It checks your system for known rootkits. Worked great on
Ubuntu, but then it failed on RH9. When I dug where it was failing, it
turns out that it was the netstat command. You see, on my Ubuntu
system, the netstat command runs and then stops. But on my RH9 system,
the netstat command runs and runs and runs and runs -- it never stops.
In fact, it complains about "bogus tcp line" periodically in the
output. As well, the output begins to repeat itself. I checked to see
if I had an alias on the netstat command and it appeared I did not.
Therefore, I uninstalled and reinstalled the netstat command, and that
failed. So then I went and found net-tools on the Internet and
recompiled it, and it still failed. So then I got into the netstat.c
code, found the if/then condition that causes the "bogus tcp line"
entry, and the return statement that followed it, and I commented both
out with /* code */. However, even that did not help and the netstat
runs continuously.

....then I bounced with ifdown/ifup.

....then I bounced with /etc/init.d/network restart.

....then I bounced the web server.

....then I bounced the sshd.

....then I bounceed the xinetd.

I tried all that so that I wouldn't have to reboot this system and blow
my uptime bragging rights.

Turns out, none of this helped. In fact, there's a KB doc at RH that
claims the "bogus tcp line" is a RH anomaly that they *STILL* haven't
fixed. In fact, they took the Microsoft approach and tried to not call
it a bug. Microsoft = RH?

Moreover, I found out that the netstat command merely does the
equivalent of a kind of grep and awk on data stored in /proc/net. So
therefore, the kernel is the fault of this problem to some degree. It's
actually a combination of the kernel and the net-tools package (the
package that contains netstat). If the kernel didn't throw up the bug
in the stats, then the netstat command would function properly. If the
netstat command had better error handling, then it would process the
data and error out without going in a continuous loop.

Unless you can recommend something else, I'm going to have to reboot
this RH9 box, blowing all my linux uptime bragging rights.

On 2006-05-03, (E-Mail Removed) <(E-Mail Removed)> wrote:
> I was having trouble running something I heard about called chkrootkit.
> You download this file, expand and compile it, and then run a Bash
> script. It checks your system for known rootkits. Worked great on
> Ubuntu, but then it failed on RH9. When I dug where it was failing, it
> turns out that it was the netstat command. You see, on my Ubuntu
> system, the netstat command runs and then stops. But on my RH9 system,
> the netstat command runs and runs and runs and runs -- it never stops.

This is not netstat's default behaviour, as you can tell from your man
page. Either chkrootkit is calling it that way (and the switch doesn't
do the same thing on ubuntu's netstat) or your netstat has been cracked.
Since you've un- and re-installed, a crack seems unlikely, but it is
possible that a crack allowed for a un-and-re-install while keeping the
cracked netstat.

> Unless you can recommend something else, I'm going to have to reboot
> this RH9 box, blowing all my linux uptime bragging rights.

Uh, what do you hope to accomplish with a reboot? If you think that'll
fix your netstat/chkrootkit issue, I seriously doubt it. You might want
to check to see how chkrootkit is calling netstat, to see if that's the
problem.

--keith

--
kkeller-(E-Mail Removed)
(try just my userid to email me)
AOLSFAQ=http://wombat.san-francisco.ca.us/cgi-bin/fom
see X- headers for PGP signature information

On 3 May 2006, in the Usenet newsgroup comp.os.linux.networking, in article
<(E-Mail Removed) .com>, (E-Mail Removed) wrote:

>I was having trouble running something I heard about called chkrootkit.
>You download this file, expand and compile it, and then run a Bash
>script. It checks your system for known rootkits.

Yeah, it's a windoze wannabe that looks for old rootkits. You might
notice that the latest version on http://www.chkrootkit.org/ is 0.46a
which was released October 28 of last year. Not staying very up to date.

>Worked great on Ubuntu, but then it failed on RH9. When I dug where it was
>failing, it turns out that it was the netstat command. You see, on my Ubuntu
>system, the netstat command runs and then stops. But on my RH9 system,
>the netstat command runs and runs and runs and runs -- it never stops.

What happens when you run the command manually? What does the command
'rpm -Vf /bin/netstat' show?

>Therefore, I uninstalled and reinstalled the netstat command, and that
>failed. So then I went and found net-tools on the Internet and
>recompiled it, and it still failed.

"that failed." - What's that supposed to mean? Did the computer catch
on fire or something?

>However, even that did not help and the netstat runs continuously.

rpm -Va > files2check

Do that as root. rpm should bitch about your modified netstat command,
but what else doesn't it like. See the man page for 'rpm' under VERIFICATION
to see what the flags mean. If rpm _doesn't_ complain, you're box is toast.

>...then I bounced with ifdown/ifup.

What is "bounced"? Are you saying that you ran those commands?

>I tried all that so that I wouldn't have to reboot this system and blow
>my uptime bragging rights.

Oh, so you're not bothering to keep the system up to date? Little hint for
you - the last _kernel_ update for RH9 was kernel-2.4.20-46.9.legacy on
March 5, or about 60 days ago. A kernel update requires a reboot, and 60
days is nothing for uptime. http://download.fedoralegacy.org/ And if
you're not bothering to update the kernel, what about the rest of the
servers/applications? 'fedoralegacy' is backporting errata from Fedora
into RH7.3 and 9 for the time being, but they're a bit slow.

>Turns out, none of this helped. In fact, there's a KB doc at RH that
>claims the "bogus tcp line" is a RH anomaly that they *STILL* haven't
>fixed. In fact, they took the Microsoft approach and tried to not call
>it a bug. Microsoft = RH?

Did you also notice that Red Hat ended support for RH9 over a year ago?
RH9 was replace by Fedora Core in November 2003, and Fedora is now on it's
fifth release since then.

>Unless you can recommend something else, I'm going to have to reboot
>this RH9 box, blowing all my linux uptime bragging rights.

If you're into windoze tools, you can try running 'rkhunter' (from
http://www.rootkit.nl/) which is similar to chkrootkit. You can also
run the 'rpm -Va' command noted above, but that assumes that your rpm
binary and the rpm database haven't been tampered with. Failing that,
wipe the sucker and install a modern distribution.

Old guy