Which to trust: chkrootkit or rkhunter?
Joe Wulf
joe_wulf at yahoo.com
Thu Jun 7 17:02:19 UTC 2012
Use a bootable disc with either or both tools on it, boot the machine(s) in question with that media and then run the tests. Fedora 17, which just came out, has a bootable security spin you could/should try, too.
>________________________________
> From: Beartooth <beartooth at comcast.net>
>To: users at lists.fedoraproject.org
>Sent: Thursday, June 7, 2012 11:16 AM
>Subject: Which to trust: chkrootkit or rkhunter?
>
>
> One tells me, on several machines, that /sbin/init is infected
>with the Suckit rootkit; the other says not. Is there a way to tell
>whether I'm seeing a false positive or a false negative?
>
> Fwiw, this result occurs both on an F16 machine, and on an f17
>one with a fresh install. (Both are fully updated.)
>
>--
>Beartooth Staffwright, Neo-Redneck Not Quite Clueless Power User
>I have precious (very precious!) little idea where up is.
>
>
>--
>users mailing list
>users at lists.fedoraproject.org
>To unsubscribe or change subscription options:
>https://admin.fedoraproject.org/mailman/listinfo/users
>Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>Have a question? Ask away: http://ask.fedoraproject.org
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/users/attachments/20120607/ef3ee1e4/attachment-0001.html>
More information about the users
mailing list