Semi-OT: Security advice, please

[Anne Wilson]

Chkrootkit runs every night on my server.  Normally there is no problem found.  
Today, though I saw these lines:

Searching for suspicious files and dirs, it may take a while... 
/usr/lib/.libgcrypt.so.11.hmac /usr/lib/firefox-3.0.15/.autoreg 
/usr/lib/.libfipscheck.so.1.1.0.hmac /usr/lib/.libfipscheck.so.1.hmac 
/usr/lib/qt-3.3/etc/settings/.qtrc.lock 
/usr/lib/qt-3.3/etc/settings/.qt_plugins_3.3rc.lock 
/usr/lib/qt-3.3/etc/settings/.kstylerc.lock /usr/lib/perl5/5.8.8/i386-linux-
thread-multi/.packlist /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-
multi/auto/DCOP/.packlist /usr/lib/gtk-2.0/immodules/.relocation-tag 
/lib/.libssl.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac 
/lib/.libcrypto.so.0.9.8e.hmac /lib/.libssl.so.6.hmac

Could these lines have been caused by crashing applications?  I had a runaway 
situation first thing this morning, possibly caused by not restarting some 
application affected by yesterday's updates, and it was so severe that I 
couldn't even find out which application was causing it.

Anne

[Kevin Kofler]

Anne Wilson wrote:
> Could these lines have been caused by crashing applications?

The .lock files, probably. The .hmac files, no, they are security 
signatures: if you enable "FIPS mode", those signatures are validated to 
make sure security libraries are not compromised (but that feature is not 
enabled by default in Fedora). Not sure what the other dotfiles are.

Kevin Kofler

[Anne Wilson]

On Sunday 01 November 2009 22:22:54 Kevin Kofler wrote:
> Anne Wilson wrote:
> > Could these lines have been caused by crashing applications?
>
> The .lock files, probably. The .hmac files, no, they are security
> signatures: if you enable "FIPS mode", those signatures are validated to
> make sure security libraries are not compromised (but that feature is not
> enabled by default in Fedora).

That sounds worth doing.  Can you tell me more about how to enable it?  There 
must be a reason why Fedora don't enable it by default, so it might be useful 
to know that as well, please.
> Not sure what the other dotfiles are.

I wasn't seriously alarmed, but felt it wise to play safe.  This morning's 
report doesn't find those files, so I assume they have been cleaned up.

Thanks for the reassurance.

Anne