Bug 456340 - "no copy of the passwd file exists" after reboot
"no copy of the passwd file exists" after reboot
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: rkhunter (Show other bugs)
9
All Linux
low Severity low
: ---
: ---
Assigned To: Kevin Fenzi
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-22 19:08 EDT by Nerijus Baliūnas
Modified: 2009-01-23 21:39 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-01-23 21:33:59 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nerijus Baliūnas 2008-07-22 19:08:18 EDT
When I reboot PC, the first rkhunter run from cron sends email:

---------------------- Start Rootkit Hunter Scan ----------------------

Warning: Unable to check for passwd file differences: no copy of the passwd file
exists.

Warning: Unable to check for group file differences: no copy of the group file
exists.



One or more warnings have been found while checking the system.

Please check the log file (/var/log/rkhunter/rkhunter.log)



----------------------- End Rootkit Hunter Scan -----------------------

From /var/log/rkhunter/rkhunter.log:
[02:04:15]   Checking for passwd file                        [ Found ]
[02:04:15] Info: Found password file: /etc/passwd
[02:04:15]   Checking for root equivalent (UID 0) accounts   [ None found ]
[02:04:15] Info: Found shadow file: /etc/shadow
[02:04:15]   Checking for passwordless accounts              [ None found ]
[02:04:15] Info: Starting test name 'passwd_changes'
[02:04:15]   Checking for passwd file changes                [ Warning ]
[02:04:15] Warning: Unable to check for passwd file differences: no copy of the
passwd file exists.
[02:04:15] Info: Starting test name 'group_changes'
[02:04:15]   Checking for group file changes                 [ Warning ]
[02:04:16] Warning: Unable to check for group file differences: no copy of the
group file exists.
[02:04:16]   Checking root account shell history files       [ OK ]
Comment 1 Kevin Fenzi 2008-07-23 00:13:32 EDT
Correct. This is expected by upstream... 
You must run 'rkhunter --propupd' to create copies of those files for it to
check against. 

From the man page: 

       --propupd
              One of the checks rkhunter performs is to compare  various  current
              file  properties  of  various commands, against those it has previ-
              ously stored. This command option causes  rkhunter  to  update  its
              data file of stored values with the current values.

              WARNING: It is the users responsibility to ensure that the files on
              the system are genuine and from a  reliable  source.  rkhunter  can
              only  report  if a file has changed, but not on what has caused the
              change. Hence, if a file has changed,  and  the  --propupd  command
              option is used, then rkhunter will assume that the file is genuine.

I'm not sure there is anything I can do package wise to get around this, 
as it's expected that the end user decides that their install is ok. 
Comment 2 Nerijus Baliūnas 2008-07-23 07:16:12 EDT
But I ran rkhunter --propupd, and rkhunter runs w/o warnings, it only happens
when I reboot. Then copies of passwd and group files disappear.
Comment 3 Kevin Fenzi 2008-07-23 15:16:47 EDT
Ah, I see what you are saying... 

Yeah, this is partially a upstream issue, and partially my fault. 
rkhunter in Fedora uses /var/run/rkhunter as it's tmpdir. This unfortunately
gets wiped on every reboot, so thats why you have to re-run it on boot. 

Possible solutions would be: 

1. Get upstream to not save passwd/shadow info in tmpdir. If those are expected
to be persistent, they shouldn't go to the tmpdir.

2. I could move them to another dir that is persistent. 

3. We could just leave it as is. After a reboot you may well want to check why
the reboot happened and that your files are ok and re-run propupd. 

I'm not sure which way to go off hand... will ponder on it. 
Any thoughts?
Comment 4 manuel wolfshant 2008-08-30 23:37:57 EDT
I suggest saving them under /var/lib/rkhunter.
Comment 5 Kevin Fenzi 2008-09-08 18:16:09 EDT
Yeah, we could do that, but upstream seems to want people to have to decide after each reboot that their setup is ok and right by running --propupd. 
If we store them in a persistent way we are changing the behavior of upstream... 

I think this is a discussion thats better made upstream. 

Nerijus / Wolfy: Would one of you be willing to take this up on the upstream lists? Or would you like me to?
Comment 6 manuel wolfshant 2008-09-12 06:24:45 EDT
Thing is that a long time ago I packaged rkhunter myself (1.2.9 at the time, upgraded to 1.3.0pre and 1.3.0 next). I have used a similar but different spec and a completely different cronjob (very simple, basically it boils down to one line: rkhunter --update && rkhunter XXXX | mail -s "rkunter job" ). And I have never seen the behaviour exhibited by the package from Fedora EPEL.
Comment 7 Kevin Fenzi 2008-12-13 20:09:44 EST
sorry for the long delay here. ;( 

I can change it to use /usr/lib/rkhunter for it's tmpdir, but thats set in the /etc/rkhunter.conf file, so on update people will get a /etc/rkhunter.conf.rpmnew file. ;( 

Should we just do that? or is there any better solution here?
Comment 8 Nerijus Baliūnas 2008-12-15 11:00:39 EST
No problem, there are times when *.rpmnew files appear. Admins should check them.
Comment 9 Kevin Fenzi 2008-12-15 17:11:05 EST
True. The other issue here is that with that change rkhunter is going to use /var/lib/rkhunter for all it's temp files, which is not very selinux friendly. 
:( 

Better would be a patch to make it store passwd/shadow in it's normal db dir, and use them from there. I can try and look at a patch to do that, but if one of you wants to do so that would be great.
Comment 10 Kevin Fenzi 2009-01-04 17:25:07 EST
Can you guys try the new package in rawhide ? 
(I can scratch build it as well if you need me to). 

I think I have propupd persisting thru reboots. 
If you guys can confirm I can push this and several other fixes to F9/F10.
Comment 11 manuel wolfshant 2009-01-04 17:51:30 EST
I'll give it a spin in Centos 4/5 as soon as I manage to persuade my mock to restart building packages.
Comment 12 manuel wolfshant 2009-01-04 19:26:52 EST
Just tested, as follows:
- removed /var/lib/rkhunter/{group, passwd}
- updated rkhunter to 1.3.4 (local built copy based on the src.rpm from koji/rawhide)
- reboot and received :
---------------------- Start Rootkit Hunter Scan ----------------------
Warning: Unable to check for passwd file differences: no copy of the passwd file exists.
Warning: Unable to check for group file differences: no copy of the group file exists.

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter/rkhunter.log)

----------------------- End Rootkit Hunter Scan -----------------------
- checked  /var/lib/rkhunter/ and the two files were there
- reboot again
- rechecked  /var/lib/rkhunter/ and the two files were still there

So I guess it's OK, at least after my very fast test
Comment 13 Kevin Fenzi 2009-01-05 00:14:25 EST
ok, great. I will push updates to testing for f10/f9 and we can get some more widespread testing.
Comment 14 Fedora Update System 2009-01-05 00:32:59 EST
rkhunter-1.3.4-1.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/rkhunter-1.3.4-1.fc10
Comment 15 Fedora Update System 2009-01-05 00:41:50 EST
rkhunter-1.3.4-1.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/rkhunter-1.3.4-1.fc9
Comment 16 Fedora Update System 2009-01-07 04:24:51 EST
rkhunter-1.3.4-1.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update rkhunter'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-0153
Comment 17 Fedora Update System 2009-01-07 04:25:50 EST
rkhunter-1.3.4-1.fc9 has been pushed to the Fedora 9 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing-newkey update rkhunter'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F9/FEDORA-2009-0163
Comment 18 Fedora Update System 2009-01-23 21:33:51 EST
rkhunter-1.3.4-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 19 Fedora Update System 2009-01-23 21:39:09 EST
rkhunter-1.3.4-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.