<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6001.18183" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2>Morning,</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I am going to treat
this as a rooted box and reinstall from scratch, but any thoughts
appreciated:</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>This is a Trixbox
Server based on Centos, running kernel 2.6.18-53.1.4.el5
SMP</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>The phone system
stopped working but this was traced to a configuration error with a replacement
switch (it did not get added to the vlan properly), which meant that Trixbox
could not see any DNS servers and this b0rks TB.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>Anyway, during
debugging I went to reboot the server and got the following:</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>/dev/kmem
missing</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>IDT table read
failed</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I have run rkhunter,
which turns up nothing</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>If have forced a
filesystem check - all clean</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I have checked the
logs and history file and cannot see anything</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>The server is behind
a hardware firewall and the only ports open are those needed for RTP, IAX2 and
SIP - there is no other public access and no user accounts.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>Having fixed the
vlan issue, Asterisk is running fine.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I re-created
/dev/kmem, but it's missing at subsequent reboots. </FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I have Googled many
references to the IDT table problem being associated with the SuckIT rootkit,
but I can find no evidence that it's installed.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>OK, bearing in mind
that I will go ahead and reinstall the server (no biggie as I have Trixbox
config backups and installing TB is not a big task), I just wanted to check
whether there were any IDT table issues that may *NOT* be rootkit related and if
there are any simple fixes I can try on the box while it's isolated on the
bench? </FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>In the other
direction, has anyone seen this type of behaviour with any rootkit that is not
detected by rkhunter and doesn't leave any obvious footprints? Anything to look
for?</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>Happy
Monday!</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2>Thanks</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2>Nigel</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV></BODY></HTML>