Which to trust: chkrootkit or rkhunter?

Joe Wulf joe_wulf at yahoo.com
Thu Jun 7 17:02:19 UTC 2012


Use a bootable disc with either or both tools on it, boot the machine(s) in question with that media and then run the tests.  Fedora 17, which just came out, has a bootable security spin you could/should try, too.




>________________________________
> From: Beartooth <beartooth at comcast.net>
>To: users at lists.fedoraproject.org 
>Sent: Thursday, June 7, 2012 11:16 AM
>Subject: Which to trust: chkrootkit or rkhunter?
> 
>
>    One tells me, on several machines, that /sbin/init is infected 
>with the Suckit rootkit; the other says not. Is there a way to tell 
>whether I'm seeing a false positive or a false negative? 
>
>    Fwiw, this result occurs both on an F16 machine, and on an f17 
>one with a fresh install. (Both are fully updated.)
>
>-- 
>Beartooth Staffwright, Neo-Redneck Not Quite Clueless Power User
>I have precious (very precious!) little idea where up is.
>
>
>-- 
>users mailing list
>users at lists.fedoraproject.org
>To unsubscribe or change subscription options:
>https://admin.fedoraproject.org/mailman/listinfo/users
>Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>Have a question? Ask away: http://ask.fedoraproject.org
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/users/attachments/20120607/ef3ee1e4/attachment-0001.html>


More information about the users mailing list