![在 15.10 上更新 rkhunter 定义时出现“[:二进制:意外运算符”消息](https://linux22.com/image/1130314/%E5%9C%A8%2015.10%20%E4%B8%8A%E6%9B%B4%E6%96%B0%20rkhunter%20%E5%AE%9A%E4%B9%89%E6%97%B6%E5%87%BA%E7%8E%B0%E2%80%9C%5B%3A%E4%BA%8C%E8%BF%9B%E5%88%B6%3A%E6%84%8F%E5%A4%96%E8%BF%90%E7%AE%97%E7%AC%A6%E2%80%9D%E6%B6%88%E6%81%AF.png)
从 15.04 升级到 Ubuntu GNOME 15.10 后,我注意到运行以下命令:
sudo rkhunter --update
我得到这个输出:
[ Rootkit Hunter version 1.4.2 ]
Checking rkhunter data files...
Checking file mirrors.dat [ No update ]
Checking file programs_bad.dat [ No update ]
Checking file backdoorports.dat [ No update ]
Checking file suspscan.dat [ No update ]
Checking file i18n/cn [ No update ]
Checking file i18n/de [ No update ]
Checking file i18n/en [ No update ]
/usr/bin/rkhunter: 7439: [: Binary: unexpected operator
Checking file i18n/tr [ No update ]
Checking file i18n/tr.utf8 [ No update ]
/usr/bin/rkhunter: 7439: [: Binary: unexpected operator
Checking file i18n/zh [ No update ]
Checking file i18n/zh.utf8 [ No update ]
这是日志文件的相关部分:
[20:47:33] Checking rkhunter data files...
[20:47:33] Info: Created temporary file '/var/lib/rkhunter/tmp/rkhunter.upd.80Dxz4681c'
[20:47:33] Info: Created temporary file '/var/lib/rkhunter/tmp/mirrors.dat.TQulAoe7Ji'
[20:47:33] Info: The mirrors file has been rotated: /var/lib/rkhunter/db/mirrors.dat
[20:47:33] Info: Executing download command '/usr/bin/wget -q -O "/var/lib/rkhunter/tmp/rkhunter.upd.80Dxz4681c" http://rkhunter.sourceforge.net/1.3/mirrors.dat 2>/dev/null'
[20:47:33] Info: This version : 2007060601
[20:47:34] Info: Latest version: 2007060601
[20:47:34] Checking file mirrors.dat [ No update ]
[20:47:34] Info: Executing download command '/usr/bin/wget -q -O "/var/lib/rkhunter/tmp/rkhunter.upd.80Dxz4681c" http://rkhunter.sourceforge.net/1.3/programs_bad.dat 2>/dev/null'
[20:47:34] Info: This version : 2014042901
[20:47:34] Info: Latest version: 2014042901
[20:47:34] Checking file programs_bad.dat [ No update ]
[20:47:34] Info: Executing download command '/usr/bin/wget -q -O "/var/lib/rkhunter/tmp/rkhunter.upd.80Dxz4681c" http://rkhunter.sourceforge.net/1.3/backdoorports.dat 2>/dev/null'
[20:47:34] Info: This version : 2010111401
[20:47:34] Info: Latest version: 2010111401
[20:47:34] Checking file backdoorports.dat [ No update ]
[20:47:34] Info: Executing download command '/usr/bin/wget -q -O "/var/lib/rkhunter/tmp/rkhunter.upd.80Dxz4681c" http://rkhunter.sourceforge.net/1.3/suspscan.dat 2>/dev/null'
[20:47:35] Info: This version : 2009112901
[20:47:35] Info: Latest version: 2009112901
[20:47:35] Checking file suspscan.dat [ No update ]
[20:47:35] Info: Executing download command '/usr/bin/wget -q -O "/var/lib/rkhunter/tmp/rkhunter.upd.80Dxz4681c" http://rkhunter.sourceforge.net/1.3/i18n/1.4.2/i18n.ver 2>/dev/null'
[20:47:35] Info: This version : 2009091601
[20:47:35] Info: Latest version: 2009091601
[20:47:35] Checking file i18n/cn [ No update ]
[20:47:35] Info: This version : 2014010301
[20:47:35] Info: Latest version: 2014010301
[20:47:35] Checking file i18n/de [ No update ]
[20:47:35] Info: This version : 2013112401
[20:47:35] Info: Latest version: 2013112401
[20:47:35] Checking file i18n/en [ No update ]
[20:47:35] Info: This version : Binary file /var/lib/rkhunter/db/i18n/tr matches
[20:47:35] Info: Latest version: 2014030201
[20:47:35] Checking file i18n/tr [ No update ]
[20:47:35] Info: This version : 2014030201
[20:47:35] Info: Latest version: 2014030201
[20:47:35] Checking file i18n/tr.utf8 [ No update ]
[20:47:35] Info: This version : Binary file /var/lib/rkhunter/db/i18n/zh matches
[20:47:35] Info: Latest version: 2009091601
[20:47:35] Checking file i18n/zh [ No update ]
[20:47:35] Info: This version : 2009091601
[20:47:35] Info: Latest version: 2009091601
[20:47:35] Checking file i18n/zh.utf8 [ No update ]
那么这些错误意味着什么?我需要做些什么吗?我应该报告它们吗?
操作系统信息:
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 15.10
Release: 15.10
Codename: wily
Flavour: GNOME
GNOME Version: 3.18
封装信息:
rkhunter:
Installed: 1.4.2-3
Candidate: 1.4.2-3
Version table:
*** 1.4.2-3 0
500 http://archive.ubuntu.com/ubuntu/ wily/universe amd64 Packages
100 /var/lib/dpkg/status
答案1
这是一个愚蠢的错误。我在脚本中添加了一些echo
,结果如下:
在/usr/bin/rkhunter: 7439
脚本中尝试比较
Binary file /var/lib/rkhunter/db/i18n/tr matches
和
2014030201
每-lt
if [ $PROG_VERS -lt $LATEST_VERS ]; then
这意味着
PROG_VERS is not really a version number
真正的问题在于这一行
PROG_VERS=`grep ${GREP_OPT} '^[Vv]ersion:[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]$' "${DB_PATH}/i18n/${LANGFILE}" 2>/dev/null | tail ${TAIL_OPT}1 | cut -d: -f2`
另一个则echo
给出了
sudo grep '^[Vv]ersion:[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]$' /var/lib/rkhunter/db/i18n/tr 2>/dev/null | tail -n 1 | cut -d: -f2
这将返回
Binary file /var/lib/rkhunter/db/i18n/tr matches
看上去不太好。
有趣的是,所有“二进制文件”都是 ISO-8859 文本,例如
$ sudo file /var/lib/rkhunter/db/i18n/tr
/var/lib/rkhunter/db/i18n/tr: ISO-8859 text
让我们检查一下内容
$ sudo cat /var/lib/rkhunter/db/i18n/tr
我们看到
LOCK_USED:Kilitleme kullan�mda: zaman a��m� $1 saniye
LOCK_UNUSED:Kilitleme kullan�mda de�il
LOCK_WAIT:Kilit dosyas� bekleniyor
LOCK_FAIL:Kilit dosyas� al�namad�: rkhunter �al��mad�!
各位男士女士们,这不是真正的 ISO-8859。o_O
我试过
sudo -i
rm -r /var/lib/rkhunter/db/i18n/*
没有任何效果。一段时间后,sudo rkhunter --update
我们又遇到了同样的问题,也就是说,下载的文件编码错误。
现在来一个非常肮脏的黑客。转换所有文件的编码,例如
sudo iconv -f ISO-8859-14 /var/lib/rkhunter/db/i18n/zh -t UTF-8 -o /var/lib/rkhunter/db/i18n/zh
并再次开始更新
% sudo rkhunter --update
[ Rootkit Hunter version 1.4.2 ]
Checking rkhunter data files...
Checking file mirrors.dat [ No update ]
Checking file programs_bad.dat [ No update ]
Checking file backdoorports.dat [ No update ]
Checking file suspscan.dat [ No update ]
Checking file i18n/cn [ No update ]
Checking file i18n/de [ No update ]
Checking file i18n/en [ No update ]
Checking file i18n/tr [ No update ]
Checking file i18n/tr.utf8 [ No update ]
Checking file i18n/zh [ No update ]
Checking file i18n/zh.utf8 [ No update ]
但请记住,这只是一种手段,而不是永久的解决方案. 你应该写一个错误报告