Which to trust: chkrootkit or rkhunter?

[Kevin Fenzi]

On Thu, 7 Jun 2012 15:16:09 +0000 (UTC)
Beartooth <beartooth at comcast.net> wrote:

> 
> 	One tells me, on several machines, that /sbin/init is
> infected with the Suckit rootkit; the other says not. Is there a way
> to tell whether I'm seeing a false positive or a false negative? 

https://bugzilla.redhat.com/show_bug.cgi?id=636231
chkrootkit hasn't been updated in a long time upstream. 

rkhunter is an active project and just released 1.4.0. 

> 	Fwiw, this result occurs both on an F16 machine, and on an
> f17 one with a fresh install. (Both are fully updated.)

Yes, this false positive has been around since 2010 it seems. 

kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <http://lists.fedoraproject.org/pipermail/users/attachments/20120607/8e097105/attachment-0001.sig>