0

maybe someone can help me makes sense if these scan results are something to be worried about and if so, how to fix them. I seems that I do not have any viruses (check with Sophos AV) or rootkits, but some security related vulnerabilities.

I'm on OSX 10.9.1

Thanks!

Checking for promiscuous interfaces [ Warning ]
Possible promiscuous interfaces:
'ifconfig' command output: en4: flags=8963 mtu 1500
en3: flags=8963 mtu 1500

Checking the local host...

Performing group and account checks
Checking for passwd file [ Found ]
Checking for root equivalent (UID 0) accounts [ None found ]
Checking for passwordless accounts [ None found ]
Checking for passwd file changes [ Warning ]
Unable to check for passwd file differences: no copy of the passwd file exists.
Checking for group file changes [ Warning ]
Unable to check for group file differences: no copy of the group file exists.
Checking root account shell history files [ None found ]

Performing system configuration file checks
Checking for SSH configuration file [ Found ]
Checking if SSH root access is allowed [ OK ]
Checking if SSH protocol v1 is allowed [ Warning ]
The SSH configuration option 'Protocol' has not been set.
Checking for running syslog daemon [ Found ]
Checking for syslog configuration file [ Found ]
Checking if syslog remote logging is allowed [ Warning ]
Syslog configuration file allows remote logging: install.* @127.0.0.1:XXXXX

Performing filesystem checks
Checking /dev for suspicious file types [ Warning ]
Suspicious file types found in /dev:
/dev/fd/6: MS Windows icon resource
/dev/fd/7: MS Windows icon resource
Checking for hidden files and directories [ Warning ]
Hidden file found: /etc/.sudoers.tmp.swp: Vim swap file, version 7.3

Hidden file found: /usr/share/man/man5/.rhosts.5: troff or preprocessor input text

Improve this question
4
  • The tool should provide more information on the warning itself. Post that information. In any event, I would assume since your only getting warnings, that the tool didn't find any problems
    – Ramhound
    Commented Jan 3, 2014 at 19:29
  • Thanks, but the log file didn't provide any further infos.
    – VforVendetta
    Commented Jan 3, 2014 at 19:34
  • 2
    Seems like this tool is known for its ability to confuse normal users ( superuser.com/questions/2723/… ) I suggest you simply remove it from your utility belt.
    – Ramhound
    Commented Jan 3, 2014 at 19:35
  • Thx, didn't even see that question : )
    – VforVendetta
    Commented Jan 3, 2014 at 19:36

1 Answer 1

Reset to default
0

The page at http://forums.macrumors.com/showthread.php?t=1314421 on MacRumors Forums suggests that the warning is nothing to worry about (one user goes as far as to call Rootkit Hunter pretty much useless on Mac, but that is outside of the scope of this question). I've used Rootkit Hunter and had a false positive from an SSH configuration file, so it's not impossible to have false positives.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .