chkrootkit결과 해석좀 부탁드립니다.

안녕하십니까? 홍석범입니다.

먼저 , 해당 백도어의 소유자가 무엇이었는지 확인해 보십시오.
root 가 아닌 nobody 등 일반유저였다면 chkrootkit등을 돌릴 필요가 없습니다. 
공격자의 입장에서 단순 스캔정도만 필요했다면 굳이 root가 필요하지 않기 때문입니다.
현재까지 root 권한을 획득할 수 있는 방법은 kernel의 취약성을 이용하는 것밖에는 없으므로
커널버전을 다시한번 확인하시기 바랍니다.

현재 chkrootkit의 결과는 특이사항이 없으므로 이 결과만을 보았을 때는 root 권한을 빼앗기지 않은 것으로 보입니다만 좀 더 확신을 갖고자 한다면 rkhunter등 다른 툴도 이용해 보시기 바랍니다.

감사합니다.

전양백 님의 글

안녕하세요.. 이곳을 자주 애용하는 리눅스 유저입니다.

얼마전에 제가 관리하는 회사 서버가 해킹을 당했습니다.

백도어를 설치하고 sshd를 계속 날리더군요..

일단 백도어는 제거하고 원상복구를 했다고 했는데

chkrootkit으로 돌리니까 아래와 같이 계속 메시지 나옵니다.

이거 해석을 부탁드릴려고요..어떤 문제인지....알수가 없네요..제실력으로...

고수님들 부탁드립니다.

/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/.packlist /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/File/Temp/.packlist /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/Storable/.packlist /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/CGI/.packlist /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/Cwd/.packlist /usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/Text/.packlist /usr/lib/perl5/5.8.3/i386-linux-thread-multi/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Gaim/.packlist /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/mod_perl/.packlist /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/IO/Stringy/.packlist /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/Template/.packlist /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/MIME-tools/.packlist /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/TimeDate/.packlist /usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/Mail/.packlist /lib/modules/2.6.5-1.358smp/build/scripts/.pnmtologo.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.bin2c.cmd /lib/modules/2.6.5-1.358smp/build/scripts/basic/.docproc.cmd /lib/modules/2.6.5-1.358smp/build/scripts/basic/.fixdep.cmd /lib/modules/2.6.5-1.358smp/build/scripts/basic/.split-include.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.mk_elfconfig.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.modpost.cmd /lib/modules/2.6.5-1.358smp/build/scripts/kconfig/.conf.cmd /lib/modules/2.6.5-1.358smp/build/scripts/kconfig/.zconf.tab.o.cmd /lib/modules/2.6.5-1.358smp/build/scripts/kconfig/.mconf.o.cmd /lib/modules/2.6.5-1.358smp/build/scripts/kconfig/.libkconfig.so.cmd /lib/modules/2.6.5-1.358smp/build/scripts/kconfig/.conf.o.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.empty.o.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.file2alias.o.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.kallsyms.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.conmakehash.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.sumversion.o.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.elfconfig.h.cmd /lib/modules/2.6.5-1.358smp/build/scripts/.modpost.o.cmd /lib/modules/2.6.5-1.358smp/build/.config /lib/modules/2.6.5-1.358/build/scripts/.pnmtologo.cmd /lib/modules/2.6.5-1.358/build/scripts/.bin2c.cmd /lib/modules/2.6.5-1.358/build/scripts/basic/.docproc.cmd /lib/modules/2.6.5-1.358/build/scripts/basic/.fixdep.cmd /lib/modules/2.6.5-1.358/build/scripts/basic/.split-include.cmd /lib/modules/2.6.5-1.358/build/scripts/.mk_elfconfig.cmd /lib/modules/2.6.5-1.358/build/scripts/.modpost.cmd /lib/modules/2.6.5-1.358/build/scripts/kconfig/.conf.cmd /lib/modules/2.6.5-1.358/build/scripts/kconfig/.zconf.tab.o.cmd /lib/modules/2.6.5-1.358/build/scripts/kconfig/.mconf.o.cmd /lib/modules/2.6.5-1.358/build/scripts/kconfig/.libkconfig.so.cmd /lib/modules/2.6.5-1.358/build/scripts/kconfig/.conf.o.cmd /lib/modules/2.6.5-1.358/build/scripts/.empty.o.cmd /lib/modules/2.6.5-1.358/build/scripts/.file2alias.o.cmd /lib/modules/2.6.5-1.358/build/scripts/.kallsyms.cmd /lib/modules/2.6.5-1.358/build/scripts/.conmakehash.cmd /lib/modules/2.6.5-1.358/build/scripts/.sumversion.o.cmd /lib/modules/2.6.5-1.358/build/scripts/.elfconfig.h.cmd /lib/modules/2.6.5-1.358/build/scripts/.modpost.o.cmd /lib/modules/2.6.5-1.358/build/.config

 The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! root         2121 tty1   /sbin/mingetty tty1
! root         2128 tty3   /sbin/mingetty tty3
! root         2134 tty4   /sbin/mingetty tty4
! root         2140 tty5   /sbin/mingetty tty5