<br><br><div class="gmail_quote">On Sun, Jan 11, 2009 at 4:06 PM, Gene Heskett <span dir="ltr"><<a href="mailto:gene.heskett@verizon.net" target="_blank">gene.heskett@verizon.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div>On Sunday 11 January 2009, Kevin Fenzi wrote:<br>
>On Thu, 08 Jan 2009 20:29:49 +0000<br>
><br>
>John Horne <<a href="mailto:john.horne@plymouth.ac.uk" target="_blank">john.horne@plymouth.ac.uk</a>> wrote:<br>
>> On Thu, 2009-01-08 at 15:22 -0500, Gene Heskett wrote:<br>
>> > On Thursday 08 January 2009, John Horne wrote:<br>
><br>
>...snip...<br>
><br>
>> > Should the rpm installer have over written them? I dunno, there<br>
>> > could be problems intro'd either way in this case.<br>
>><br>
>> The rkhunter installer will not overwrite anything in /etc. The copies<br>
>> it takes of the files are for its own use and put into a separate<br>
>> secure directory. It is those files it looks for.<br>
>><br>
>> Looking at the rkhunter 1.3.2 rpm spec file (as used for the Fedora<br>
>> package), it does not seem to take an initial copy of the files. So<br>
>> that would explain why you got the initial warning. However, as has<br>
>> already been replied, the spec file for 1.3.4 FC10 does do this<br>
>> initial copy (although I cannot personally verify that).<br>
><br>
>Nope. Neither one does that. You need to run 'rkhunter --propupd' to<br>
>get it to make copies of passwd/shadow and save file properties.<br>
><br>
>The reason for that is that the package can't know anything about how<br>
>much you trust your current install when it's installed. It's up to you<br>
>to run the --propupd and tell it that you think the system is clean and<br>
>that everything should be saved.<br>
><br>
>> John.<br>
><br>
>kevin<br>
<br>
</div></div>At the time I posted the original message, I had already done that with 1.3.2,<br>
so I built 1.3.4, which did apparently do that properly when that operation<br>
was repeated.<br>
<div><br></div></blockquote><div><br>I have run rkhunter --propupd many times, I do have a copy of group and passwd<br>in /var/run/rkhunter, but I always receive an email saying that there is no copy<br>of group and passwd. Upgrading to 1.3.4 did not change anything. This<br>
happens on every computer I have rkhunter installed.<br>
</div></div><br clear="all"><br>-- <br>Paulo Roma Cavalcanti<br>LCG - UFRJ<br>