What Linux tools and security??

S0litaire

"(END)" just means the end of the file.
To get out, press ":" then "q" then hit enter, that closes the program and gets you back to the command line.

You can usually ignore the "Suspicious files and directories" list since there's no other problems found.

It looks like your clean and safe, so relax and go back to enjoying a free (in cost and worry!) OS ^_^ lol

tweeter

Thanks for all your replies. I've come a bit late in life to linux what with one foot in the grave as they say, I'll try a bit harder to keep up. Cheers.

fwor

Just run chkrootkit on my main PC and I get almost exactly the same "suspicious files" message as you do!

I'll look into it a bit further but, as this installation was a fresh install of 10.04 done less than 2 weeks ago, I'm fairly sure it's a false positive.

Edit: Found further evidence that it (probably) is. This bug report identifies similar files (associated with Firefox and Java JRE) and it seems to be accepted that they are false positives:

https://bugs.launchpad.net/ubuntu/+source/chkrootkit/+bug/575945

tweeter

Thanks fwor, as I'm really out of my depth. I'm on 10.04 as well!

S0litaire

Also you should install "denyhosts" and "fail2ban" it's a bit over kill but it will stop people trying to gain remote access to your machine by trying to guess your password (It's usually kiddies running programs trying to attack other window machines, but it's better safe than sorry.)

It will block external IP addresses, if they fail 2 or more attempts to enter in a password (the block is only temporary but enough to deter most attacks.)

sudo apt-get install fail2ban denyhosts

tweeter

Will installing this mean I have to do anything or does it just run in the background.Cheers.

edit : I've just looked them up in the Ubuntu Software Centre and will go onto the websites later.

S0litaire

The 2 I mentioned run in the background you don't need to do anything once installed...

You check the Log files

less /var/log/fail2ban.log 
less /var/log/denthosts

From time to time to see what they've been up to but it will usually be empty or just starting and stopping messages unless people are being blocked.

tweeter

Thanks S0litaire.

fwor

S0litaire wrote: »

Also you should install "denyhosts" and "fail2ban"

Interesting - yet more tools I'd never heard of!

I suspect that few people will actually need to use these, though. You really only need them if you use a "directly connected" broadband modem on your PC (i.e. the cheap USB-connected ones) or have a PC with ports explicitly open on the Internet via the router.

For the average person sitting on an ethernet connection behind a router they aren't needed, because there is no route in to your local network for the port scanner script kiddies.

weegie.geek

A surprising amount of people still use the speedtouch USB adsl modems, and a lot of cable customers are just using the modem directly into the PC.

Then there's people who couldn't get something working properly so put their pc in the DMZ and didn't take it back out...