Help - Zoeken - Gebruikers - Kalender
Volledige versie: Chkrootkit finds Suckit rootkit
MandrivaClub.NL > MCNLive > MCNLive: International
azenz
Chkrootkit says warning - /sbin/init infected with suckit.

I don't have my original MCNlive Virtualcity ISO any more (working with a remaster). Would anyone mind helping to check what the original /sbin/init file looks like?

My file looks like this:
-rwxr-x--- 1 root root 35264 Jul 2 2006 /sbin/init*

I have read about occasional false positives with this one, but do want to be certain what's going on...smile.gif

Thanks so much!!!

Adrian
kris
CODE
[chris@localhost ~]$ ls -l /sbin/init
-rwxr-xr-x 1 root root 35264 Jul  2  2006 /sbin/init*
[chris@localhost ~]$


How did you manage to get wrong permissions?
azenz
I changed a number of key system file permissions to 750, based on Linux security recommendations. Do you think that that triggered it?
kris
Don't worry, Adrian.

Nothing wrong with the /sbin/init.

An explanation. When we build a livecd iso, the original /sbin/init is copied to /sbin/init.dynamic
(search for /sbin/init in: /usr/sbin/mklivecd)

When starting the system it is being copied back as /sbin/init

(search for /sbin/init in: /usr/share/mklivecd/linuxrc )

chkrootkit does not like this, or better: is aware of it.

It is still the original, unaffected /sbin/init

I don't know about the permissions. If it works for you ...
azenz
Hey Christ, thanks! As always, your fast help is the best aspect of MCNLive... smile.gif

The permissions advice you will find on just about every website that discusses Linux security and so far it hasn't caused any problems.
kris
Thanks to you for reporting.

One more reason for me to revise the whole (old) mklivecd code.
It is getting old.
azenz
QUOTE
One more reason for me to revise the whole (old) mklivecd code.
It is getting old.


Yes, I think that would be a great idea. It could well be the reason behind some of the remastering problems that I and a friend of mine have had. Looking forward to it! smile.gif

By the way, is the new remastering GUI also available for folks with older versions like me? Could it possibly be posted on the forum/website if it is compatible?
kris
Will post it this evening (European time) when I am back from work.

But it's worth to download Toronto. It is WAY faster with VirtualBox.
HighKing
(azenz @ May 30 2007, 11:19 AM) [snapback]85798[/snapback]
By the way, is the new remastering GUI also available for folks with older versions like me? Could it possibly be posted on the forum/website if it is compatible?

I believe this is the latest one (the 'pro' version tongue.gif)
Save it in a text-file, and make it executable. You might have to install 'bc' first for it to work correctly (just type #urpmi bc).
#!/bin/bash

# Graphical remaster script
# (C) 2007 HighKing & Chris and mandrivaclub.nl
# License GPL 2.0 or later

# Set script title
TITLE="MCNLive remaster-on-the-fly"

# Check if kdialog exists, if not, use gdialog (wrapper for zenity) for some dialogs.
# Note: Most dialogs are pure zenity, but zenity does not have the yes/no function :(
if [ -f /usr/bin/kdialog ]; then
    DIALOG=kdialog
else
    DIALOG=gdialog
fi

# Check if user is logged in as root
if [ "$UID" != "0" ]; then
    zenity --error --title="$TITLE" --text="Please run this script as root!"
    exit 0
fi

# Check wether or not we're running in live mode.
if [ -d "/union" ]; then
    echo "Running in live mode..."
    ROOT=/union
else
    echo "Running in installed mode..."
    ROOT=/
fi

# First question: Are you sure?
zenity --width=400 --height=400 --title "$TITLE" --question --text "You're about to create a remaster of this live cd.\n
* A compressed image of the running live system will be created on a chosen partition.\n
* Requirements: min. 512 MB RAM, min. 2 GB free space on the chosen partition.\n
* A Windows FAT filesystem can't be used. A Windows NTFS partition must be mounted read-write which is not the default! (Start MCNLive with 'livecd ntfsrw')\n
* If you are unsure read on in the HowTo page in your browser, and press 'Cancel'."
if [ "$?" == "1" ]; then
    zenity --info --text="You chose not to continue ..." --title="$TITLE"
    exit 0
fi

$DIALOG --title $TITLE --yesno "Would you like to provide some advanced options?

For Example: --keyb=fr"
if [ "$?" == "0" ]; then
    # Ask for custom boot screens
    $DIALOG --title $TITLE --yesno "Would you like to use your own customized boot screens?"
    if [ "$?" == "0" ]; then
        BOOTSCR=$(zenity --title="Please select your splash message" --file-selection --filename=/home/guest/splash.msg);
        if [ "$?" == "1" ]; then
            BOOTSCR=/home/guest/splash.msg
        fi

        BOOTF1=$(zenity --title="Please select your F1 bootscreen" --file-selection --filename=/home/guest/myboot.msg);
        if [ "$?" == "1" ]; then
            BOOTF1=/home/guest/myboot.msg
        fi

        BOOTF2=$(zenity --title="Please select your F2 bootscreen" --file-selection --filename=/home/guest/help2.msg);
        if [ "$?" == "1" ]; then
            BOOTF2=/home/guest/help2.msg
        fi
    else
        BOOTSCR=/home/guest/splash.msg
        BOOTF1=/home/guest/myboot.msg
        BOOTF2=/home/guest/help2.msg
    fi
    
    # Ask for special mklivecd options
    OPTIONS=$(zenity --title="$TITLE" --entry --text="Insert your mklivecd options here:
Note: any wrong option will break the command!")
else
    BOOTSCR=/home/guest/splash.msg
    BOOTF1=/home/guest/myboot.msg
    BOOTF2=/home/guest/help2.msg
    OPTIONS=""
fi

# Set the directory for the temporary files
if [ "$ROOT" == "/" ]; then
    TMPPART=/
else
    # Ask for a place for the temporary files
    TMPDEV=$(df -h --exclude-type=vfat --exclude-type=ntfs | grep 'hd\|sd' |
    zenity --list --title="$TITLE" --text="Select a partition for the temporary files." --width=400 --height=200 --column=Partitie)
        # If a user pressed the cancel button, just quit
        if [ "$?" == "1" ]; then
            exit 0
        fi
    TMPDEV=$(echo "$TMPDEV" | cut -b1-9)
    TMPPART=$(mount | grep $TMPDEV | cut -f 3 -d ' ')

    # Set needed space on the temporary partition...
    ROOTSPACE=$(df -h / | grep / | cut -b28-34 | sed s/G/*1024/\;s/M//\;s/,/./ | bc)
    UNIONSPACE=$(df -h /union | grep /union | cut -b28-34 | sed s/G/*1024/\;s/M//\;s/,/./ | bc)
    NEEDSPACE=$(echo "{($ROOTSPACE+$UNIONSPACE*2.1)/1}"|bc)
    echo "Needed space on temporary partition: "$NEEDSPACE"M"

    # Check if TMPPART has enough space to do the remaster (at least the value of NEEDSPACE)
    FREESPACE=$(df -h $TMPPART | grep $TMPPART | cut -b35-40 | sed s/G/*1024/\;s/M//\;s/,/./ | bc)
    FREESPACE=$(echo "{$FREESPACE/1}" | bc)
    echo -n "Chosen partition has "$FREESPACE"Mb of free space... "

    if [ "$FREESPACE" -gt "$NEEDSPACE" ]; then
            echo "that should be enough."
    else
            echo "that is NOT enough."
            zenity --error --title="$TITLE" --text="Chosen partition has not enough free space left\nYou will need at least $NEEDSPACE MB free!"
            exit 1
    fi
    # Check if /tmp directory exist on device
    if [ -d "$TMPPART/tmp" ]; then
            TMPDIR="$TMPPART/tmp"
    else
            TMPDIR="$TMPPART"
    fi
fi

# Remove any pre-existing mkremaster temporary directories
testmklivecd=$(echo $TMPDIR"mklivecd.*");
rm -rf $testmklivecd

# Ask where to put the remaster
ISOFILE=$(zenity --title="$TITLE" --file-selection --save --filename=$TMPPART/remaster.iso);
if [ "$?" == "1" ]; then
    echo "Cancelled!"
    exit 1
fi

# Create the remaster
echo "Running mklivecd to create the remaster..."
konsole -T 'Creating your personal remaster...' --nomenubar --notabbar -e mklivecd --verbose --root=$ROOT --tmp=$TMPDIR --bootmsg $BOOTSCR --bootkey F1=$BOOTF1 --bootkey F2=$BOOTF2 $OPTIONS $ISOFILE >/dev/null 2>&1

# Check if the mklivecd temporary files are removed, if not
# something must have gone wrong! :-(
testmklivecd=$( ls -d $tmpdir* | grep mklivecd. );
if [ "$testmklivecd" == "" ]; then
    echo "mklivecd temp dir does not exist anymore... (this is actually a good thing)"
else
    zenity --title="$TITLE" --error --text="Something went wrong! :-("
    exit 1
fi

# Check if the remaster iso actually exists, and if yes, calculate the md5-sum.
if [ -f $ISOFILE ]; then
    # I stole this line from the Make MD5 script on http://g-scripts.sf.net
    # It doesn't quite work though, at least I don't get to see any progres....
    ( md5sum $ISOFILE > $ISOFILE.md5.txt ) 2>&1 | zenity --progress --title="$TITLE" --text="Creating MD5SUM check file" --pulsate --auto-close
else
    zenity --title="$TITLE" --error --text="Something went wrong! :-("
    exit 1
fi

# Popup notification, tell the user that we're done
ISOMD5=$(cat $ISOFILE.md5.txt | cut -b1-32);
zenity --info --title="$TITLE" --text="The remaster was created successfully\!\n\nIt is created in $ISOFILE.\nThe MD5 sum of the file is:\n$ISOMD5"

# The end! :-)
exit 0
kris
That is the wrong version laugh.gif

Adrian: We have different versions in Delft and Toronto, Toronto has a new way of isolinux boot splash that can't work on older systems.

Also, we have two versions of the mkremaster wizards, a simple and an advanced.

And to make it even more complicated, Michel keeps posting his (advanced) version without a valid © and license laugh.gif
azenz
Thanks! smile.gif
HighKing
(kris @ May 30 2007, 12:01 PM) [snapback]85802[/snapback]
That is the wrong version laugh.gif
I believe that's the one in Delft, and I tested it on VirtualCity as well ;).gif

Adrian: We have different versions in Delft and Toronto, Toronto has a new way of isolinux boot splash that can't work on older systems.

Also, we have two versions of the mkremaster wizards, a simple and an advanced.
And this is the 'advanced', or 'pro' one as I already mentioned ;).gif

And to make it even more complicated, Michel keeps posting his (advanced) version without a valid © and license laugh.gif
Sorry about that.... edited it, better now? laugh.gif
kris
laugh.gif, my 'wrong version' was a joke. (--> reg. the copyright and the license)

Sorry, boys.

Adrian. You can trust HighKing = Michel. He is the author of this script.
azenz
Sounds good, I will let you know if my machine explodes or not....smile.gif
HighKing
(azenz @ May 30 2007, 05:12 PM) [snapback]85809[/snapback]
Sounds good, I will let you know if my machine explodes or not....smile.gif
Well, I did indeed include a little exploding device in the script... laugh.gif
azenz
Man, you did!! But my fire extinguisher wasn't far off... tongue.gif
Dit is een "Print" versie van onze forums. Om de volledige versie met meer informatie, afbeeldingen en opmaakte bekijken, a.u.b. klik hier.