Pages : 1
#1 Le 20/07/2012, à 23:05
- iro
signatures non valides [resolu]
Bonsoir,
Il y a quelques jours il m’était impossible de faire les mises a jour, que se soit par le gestionnaire ou par synaptic.
En regardant le man de apt-get, j'ai tape plusieurs commandes (du coup ça refonctionne) mais en tapant sudo apt-get update j'ai vu ça:
W: Erreur de GPG : http://ppa.launchpad.net precise Release : Les signatures suivantes ne sont pas valables : BADSIG 6AF0E1940624A220 Launchpad PPA for TualatriX
W: Erreur de GPG : http://archive.canonical.com oneiric Release : Les signatures suivantes ne sont pas valables : BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>nmap me dit que tous les ports de mon adresse sont bloque.
Quand au localhost: 53/tcp open domain 631/tcp open ipp .(Je pense que ces 2 ports ouvert c'est normal, a confirmer.)
J'ai effectue les tests anti-rootkits qui non rien donnes a parement:
iro@Aspire-5110:/home/net$ sudo chkrootkit
[sudo] password for iro:
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `crontab'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not found
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not found
Checking `mingetty'... not found
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not found
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not found
Checking `syslogd'... not tested
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for rootkit HiDrootkit's default files... nothing found
Searching for rootkit t0rn's default files... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for rootkit Lion's default files... nothing found
Searching for rootkit RSHA's default files... nothing found
Searching for rootkit RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:
/usr/lib/pymodules/python2.7/.path /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for ENYELKM rootkit default files... nothing found
Searching for common ssh-scanners default files... nothing found
Searching for suspect PHP files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
chkdirs: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
wlan0: PACKET SNIFFER(/sbin/wpa_supplicant[1163], /sbin/dhclient[10796])
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... user net deleted or never logged from lastlog!
Checking `chkutmp'... chkutmp: nothing deleted
Checking `OSX_RSPLUG'... not infected
iro@Aspire-5110:/home/net$ sudo rkhunter --checkall
[ Rootkit Hunter version 1.3.8 ]
Checking system commands...
Performing 'strings' command checks
Checking 'strings' command [ OK ]
Performing 'shared libraries' checks
Checking for preloading variables [ None found ]
Checking for preloaded libraries [ None found ]
Checking LD_LIBRARY_PATH variable [ Not found ]
Performing file properties checks
Checking for prerequisites [ OK ]
/usr/sbin/adduser [ OK ]
/usr/sbin/chroot [ OK ]
/usr/sbin/cron [ OK ]
/usr/sbin/groupadd [ OK ]
/usr/sbin/groupdel [ OK ]
/usr/sbin/groupmod [ OK ]
/usr/sbin/grpck [ OK ]
/usr/sbin/nologin [ OK ]
/usr/sbin/pwck [ OK ]
/usr/sbin/rsyslogd [ OK ]
/usr/sbin/tcpd [ OK ]
/usr/sbin/useradd [ OK ]
/usr/sbin/userdel [ OK ]
/usr/sbin/usermod [ OK ]
/usr/sbin/vipw [ OK ]
/usr/bin/awk [ OK ]
/usr/bin/basename [ OK ]
/usr/bin/chattr [ OK ]
/usr/bin/cut [ OK ]
/usr/bin/diff [ OK ]
/usr/bin/dirname [ OK ]
/usr/bin/dpkg [ OK ]
/usr/bin/dpkg-query [ OK ]
/usr/bin/du [ OK ]
/usr/bin/env [ OK ]
/usr/bin/file [ OK ]
/usr/bin/find [ OK ]
/usr/bin/GET [ OK ]
/usr/bin/groups [ OK ]
/usr/bin/head [ OK ]
/usr/bin/id [ OK ]
/usr/bin/killall [ OK ]
/usr/bin/last [ OK ]
/usr/bin/lastlog [ OK ]
/usr/bin/ldd [ OK ]
/usr/bin/less [ OK ]
/usr/bin/locate [ OK ]
/usr/bin/logger [ OK ]
/usr/bin/lsattr [ OK ]
/usr/bin/lsof [ OK ]
/usr/bin/md5sum [ OK ]
/usr/bin/mlocate [ OK ]
/usr/bin/newgrp [ OK ]
/usr/bin/passwd [ OK ]
/usr/bin/perl [ OK ]
/usr/bin/pgrep [ OK ]
/usr/bin/pstree [ OK ]
/usr/bin/rkhunter [ OK ]
/usr/bin/runcon [ OK ]
/usr/bin/sha1sum [ OK ]
/usr/bin/sha224sum [ OK ]
/usr/bin/sha256sum [ OK ]
/usr/bin/sha384sum [ OK ]
/usr/bin/sha512sum [ OK ]
/usr/bin/size [ OK ]
/usr/bin/sort [ OK ]
/usr/bin/stat [ OK ]
/usr/bin/strace [ OK ]
/usr/bin/strings [ OK ]
/usr/bin/sudo [ OK ]
/usr/bin/tail [ OK ]
/usr/bin/test [ OK ]
/usr/bin/top [ OK ]
/usr/bin/touch [ OK ]
/usr/bin/tr [ OK ]
/usr/bin/uniq [ OK ]
/usr/bin/users [ OK ]
/usr/bin/vmstat [ OK ]
/usr/bin/w [ OK ]
/usr/bin/watch [ OK ]
/usr/bin/wc [ OK ]
/usr/bin/wget [ OK ]
/usr/bin/whatis [ OK ]
/usr/bin/whereis [ OK ]
/usr/bin/which [ OK ]
/usr/bin/who [ OK ]
/usr/bin/whoami [ OK ]
/usr/bin/unhide.rb [ Warning ]
/usr/bin/mawk [ OK ]
/usr/bin/lwp-request [ OK ]
/usr/bin/w.procps [ OK ]
/sbin/depmod [ OK ]
/sbin/fsck [ OK ]
/sbin/ifconfig [ OK ]
/sbin/ifdown [ OK ]
/sbin/ifup [ OK ]
/sbin/init [ OK ]
/sbin/insmod [ OK ]
/sbin/ip [ OK ]
/sbin/lsmod [ OK ]
/sbin/modinfo [ OK ]
/sbin/modprobe [ OK ]
/sbin/rmmod [ OK ]
/sbin/route [ OK ]
/sbin/runlevel [ OK ]
/sbin/sulogin [ OK ]
/sbin/sysctl [ OK ]
/bin/bash [ OK ]
/bin/cat [ OK ]
/bin/chmod [ OK ]
/bin/chown [ OK ]
/bin/cp [ OK ]
/bin/date [ OK ]
/bin/df [ OK ]
/bin/dmesg [ OK ]
/bin/echo [ OK ]
/bin/ed [ OK ]
/bin/egrep [ OK ]
/bin/fgrep [ OK ]
/bin/fuser [ OK ]
/bin/grep [ OK ]
/bin/ip [ OK ]
/bin/kill [ OK ]
/bin/less [ OK ]
/bin/login [ OK ]
/bin/ls [ OK ]
/bin/lsmod [ OK ]
/bin/mktemp [ OK ]
/bin/more [ OK ]
/bin/mount [ OK ]
/bin/mv [ OK ]
/bin/netstat [ OK ]
/bin/ps [ OK ]
/bin/pwd [ OK ]
/bin/readlink [ OK ]
/bin/sed [ OK ]
/bin/sh [ OK ]
/bin/su [ OK ]
/bin/touch [ OK ]
/bin/uname [ OK ]
/bin/which [ OK ]
/bin/dash [ OK ]
[Press <ENTER> to continue]
Checking for rootkits...
Performing check of known rootkit files and directories
55808 Trojan - Variant A [ Not found ]
ADM Worm [ Not found ]
AjaKit Rootkit [ Not found ]
Adore Rootkit [ Not found ]
aPa Kit [ Not found ]
Apache Worm [ Not found ]
Ambient (ark) Rootkit [ Not found ]
Balaur Rootkit [ Not found ]
BeastKit Rootkit [ Not found ]
beX2 Rootkit [ Not found ]
BOBKit Rootkit [ Not found ]
cb Rootkit [ Not found ]
CiNIK Worm (Slapper.B variant) [ Not found ]
Danny-Boy's Abuse Kit [ Not found ]
Devil RootKit [ Not found ]
Dica-Kit Rootkit [ Not found ]
Dreams Rootkit [ Not found ]
Duarawkz Rootkit [ Not found ]
Enye LKM [ Not found ]
Flea Linux Rootkit [ Not found ]
FreeBSD Rootkit [ Not found ]
Fu Rootkit [ Not found ]
Fuck`it Rootkit [ Not found ]
GasKit Rootkit [ Not found ]
Heroin LKM [ Not found ]
HjC Kit [ Not found ]
ignoKit Rootkit [ Not found ]
iLLogiC Rootkit [ Not found ]
IntoXonia-NG Rootkit [ Not found ]
Irix Rootkit [ Not found ]
Kitko Rootkit [ Not found ]
Knark Rootkit [ Not found ]
ld-linuxv.so Rootkit [ Not found ]
Li0n Worm [ Not found ]
Lockit / LJK2 Rootkit [ Not found ]
Mood-NT Rootkit [ Not found ]
MRK Rootkit [ Not found ]
Ni0 Rootkit [ Not found ]
Ohhara Rootkit [ Not found ]
Optic Kit (Tux) Worm [ Not found ]
Oz Rootkit [ Not found ]
Phalanx Rootkit [ Not found ]
Phalanx2 Rootkit [ Not found ]
Phalanx2 Rootkit (extended tests) [ Not found ]
Portacelo Rootkit [ Not found ]
R3dstorm Toolkit [ Not found ]
RH-Sharpe's Rootkit [ Not found ]
RSHA's Rootkit [ Not found ]
Scalper Worm [ Not found ]
Sebek LKM [ Not found ]
Shutdown Rootkit [ Not found ]
SHV4 Rootkit [ Not found ]
SHV5 Rootkit [ Not found ]
Sin Rootkit [ Not found ]
Slapper Worm [ Not found ]
Sneakin Rootkit [ Not found ]
'Spanish' Rootkit [ Not found ]
Suckit Rootkit [ Not found ]
SunOS Rootkit [ Not found ]
SunOS / NSDAP Rootkit [ Not found ]
Superkit Rootkit [ Not found ]
TBD (Telnet BackDoor) [ Not found ]
TeLeKiT Rootkit [ Not found ]
T0rn Rootkit [ Not found ]
trNkit Rootkit [ Not found ]
Trojanit Kit [ Not found ]
Tuxtendo Rootkit [ Not found ]
URK Rootkit [ Not found ]
Vampire Rootkit [ Not found ]
VcKit Rootkit [ Not found ]
Volc Rootkit [ Not found ]
Xzibit Rootkit [ Not found ]
X-Org SunOS Rootkit [ Not found ]
zaRwT.KiT Rootkit [ Not found ]
ZK Rootkit [ Not found ]
Performing additional rootkit checks
Suckit Rookit additional checks [ OK ]
Checking for possible rootkit files and directories [ None found ]
Checking for possible rootkit strings [ None found ]
Performing malware checks
Checking running processes for suspicious files [ None found ]
Checking for login backdoors [ None found ]
Checking for suspicious directories [ None found ]
Checking for sniffer log files [ None found ]
Performing Linux specific checks
Checking loaded kernel modules [ OK ]
Checking kernel module names [ OK ]
[Press <ENTER> to continue]
Checking the network...
Performing checks on the network ports
Checking for backdoor ports [ None found ]
Checking for hidden ports [ Skipped ]
Performing checks on the network interfaces
Checking for promiscuous interfaces [ None found ]
Checking the local host...
Performing system boot checks
Checking for local host name [ Found ]
Checking for system startup files [ Found ]
Checking system startup files for malware [ None found ]
Performing group and account checks
Checking for passwd file [ Found ]
Checking for root equivalent (UID 0) accounts [ None found ]
Checking for passwordless accounts [ None found ]
Checking for passwd file changes [ None found ]
Checking for group file changes [ None found ]
Checking root account shell history files [ None found ]
Performing system configuration file checks
Checking for SSH configuration file [ Not found ]
Checking for running syslog daemon [ Found ]
Checking for syslog configuration file [ Found ]
Checking if syslog remote logging is allowed [ Not allowed ]
Performing filesystem checks
Checking /dev for suspicious file types [ None found ]
Checking for hidden files and directories [ Warning ]
[Press <ENTER> to continue]
System checks summary
=====================
File properties checks...
Files checked: 132
Suspect files: 1
Rootkit checks...
Rootkits checked : 242
Possible rootkits: 0
Applications checks...
All checks skipped
The system checks took: 1 minute and 26 seconds
All results have been written to the log file (/var/log/rkhunter.log)
One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)J'aurai voulu savoir si mon ordi est compromis, merci de votre aide voir conseils
Dernière modification par iro (Le 23/07/2012, à 02:38)
Aime la vie et vis la vie que tu aimes.
Boinc pour aider la science.
Hors ligne
#2 Le 21/07/2012, à 10:47
- xavier4811
Re : signatures non valides [resolu]
Bonjour,
Pour les problèmes apt, jette un oeil sur cette page : probleme_apt
Pour les ports, le 53 doit être le DNS et le 631 c'est cups.
Quand au rapport rkhunter,
Suspect files: 1le fichier unhide.rb est un faux positif, c'est un fichier légitime.
Pour ma part, je ne vois rien d'inquétant.
Hors ligne
#3 Le 21/07/2012, à 11:22
- vince06fr
Re : signatures non valides [resolu]
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6AF0E1940624A220
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5
sudo apt-get updateHors ligne
#4 Le 21/07/2012, à 11:58
- iro
Re : signatures non valides [resolu]
iro@Aspire-5110:/home/net$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6AF0E1940624A220
[sudo] password for iro:
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /tmp/tmp.SUSogwraQn --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 6AF0E1940624A220
gpg: requête de la clé 0624A220 du serveur hkp keyserver.ubuntu.com
?: keyserver.ubuntu.com: Connection timed out
gpgkeys: HTTP fetch error 7: couldn't connect: Connection timed out
gpg: aucune donnée OpenPGP valide n'a été trouvée.
gpg: Quantité totale traitée: 0
iro@Aspire-5110:/home/net$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /tmp/tmp.rfSyXNpE1O --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5
gpg: requête de la clé 437D05B5 du serveur hkp keyserver.ubuntu.com
?: keyserver.ubuntu.com: Connection timed out
gpgkeys: HTTP fetch error 7: couldn't connect: Connection timed out
gpg: aucune donnée OpenPGP valide n'a été trouvée.
gpg: Quantité totale traitée: 0apt-get update me donne la même chose.
Je suspectai une intrusion: -paramètres qui changent sans raison
-plusieurs malwares sur win (j'ai du reinstaller 2 fois en 4 mois 
ce qui m'a decide pour ubuntu)
Je suppose que le lamer a mon ip et mon mac.
Mais si vous pensez qu'il n'y a rien ...
Merci de me rassurer 
Aime la vie et vis la vie que tu aimes.
Boinc pour aider la science.
Hors ligne
#5 Le 21/07/2012, à 22:38
- vince06fr
Re : signatures non valides [resolu]
iro a écrit :
Je suspectai une intrusion: -paramètres qui changent sans raison
-plusieurs malwares sur win (j'ai du reinstaller 2 fois en 4 mois mad ce qui m'a decide pour ubuntu)
Je suppose que le lamer a mon ip et mon mac.Mais si vous pensez qu'il n'y a rien ...
Merci de me rassurer cool
Franchement à moins que tu fasses tourner plein de service du genre ssh, http, samba, lamp, etc sans un minimum de protection, que veux tu qu'il fasse avec ton ip et ton adresse mac??
Bon et j'ai supposé que tu es derriere un routeur dont tous les ports ne sont pas ouvert bien sûr.
Si tu veux plus de sécurité, active le pare-feu :
sudo ufw enablela politique par defaut de UFW est de bloquer toutes les connexions entrantes, ensuite c'est assez simple à parametrer :
http://doc.ubuntu-fr.org/ufw
Si tu prefere avoir un interface graphique il existe un GUI :
sudo apt-get install gufwPour en revenir avec ton problème de gpg :
Apparemment tu n'arrive pas à télécharger la clef public des 2 dépôts, essaye :
sudo apt-key adv --recv-keys --keyserver hkp://subkeys.pgp.net 6AF0E1940624A220
sudo apt-key adv --recv-keys --keyserver hkp://subkeys.pgp.net 40976EAF437D05B5comme indiqué là
Si ça ne fonctionne toujours pas fait
sudo rm -r /var/lib/apt/lists
sudo mkdir -p /var/lib/apt/lists/partial
sudo apt-get updateComme indiqué là
Il faudra peut être relancer les commandes pour télécharger les clefs
Dernière modification par vince06fr (Le 21/07/2012, à 22:51)
Hors ligne
#6 Le 22/07/2012, à 15:45
- iro
Re : signatures non valides [resolu]
Merci,
pour gpg j'ai fait les commandes qui ont fonctionne.
J'avais déjà active le pare feu.
Pour l'ip et@mac avec des bon programmes (sniffer et autre) je pense que l'on peut s'introduire(pour ca il suffit de visiter le forum Backtrack) car je me connecte via wifi public.J'ai téléchargé Bastille pour augmenter la secu
Aime la vie et vis la vie que tu aimes.
Boinc pour aider la science.
Hors ligne
#7 Le 22/07/2012, à 23:08
- vince06fr
Re : signatures non valides [resolu]
Si tu es un simple poste client, je ne pense pas que ce soit si simple(je connais un peu backtrack...). Si tu fait tourner un ou plusieurs serveurs, tu augmente les portes d'entrée à surveiller...
Maintenant, je ne suis pas un spécialiste en sécurité...
Si ton problème est résolu, n'oublie pas de passer ton poste en résolu
Dernière modification par vince06fr (Le 22/07/2012, à 23:14)
Hors ligne
#8 Le 23/07/2012, à 02:38
- iro
Re : signatures non valides [resolu]
Ok, merci 
Aime la vie et vis la vie que tu aimes.
Boinc pour aider la science.
Hors ligne
#9 Le 30/07/2012, à 16:00
- iro
Re : signatures non valides [resolu]
Bonjour,
j'ai un nouveau problème avec apt-get.Les mises a jours sont reconnues mais ne peuvent pas être installées
sudo apt-get update
E: Impossible d'obtenir le verrou /var/lib/apt/lists/lock - open (11: Ressource temporairement non disponible)
E: Impossible de verrouiller le répertoire /var/lib/apt/lists/
E: Impossible d'obtenir le verrou /var/lib/dpkg/lock - open (11: Ressource temporairement non disponible)
E: Impossible de verrouiller le répertoire d'administration (/var/lib/dpkg/). Il est possible qu'un autre processus l'utilise.Merci de votre aide
Aime la vie et vis la vie que tu aimes.
Boinc pour aider la science.
Hors ligne
#10 Le 30/07/2012, à 16:42
- xavier4811
Re : signatures non valides [resolu]
iro a écrit :
Il est possible qu'un autre processus l'utilise.Merci de votre aide
Surement update-manager, reboot et retente, ça devrait passer.
Hors ligne
#11 Le 30/07/2012, à 18:04
- iro
Re : signatures non valides [resolu]
Merci,
après reboot j'ai réussi les mises a jour
Aime la vie et vis la vie que tu aimes.
Boinc pour aider la science.
Hors ligne
Pages : 1