El Miércoles, 11 de Octubre de 2006 04:07, hanpingtian(a)gmail.com escribió:
Today I find that some strange things happened on rkhunter, some
files
belong to it missing:
$ rpm -V rkhunter
..?..... /etc/cron.daily/01-rkhunter
..?..... /etc/rkhunter.conf
..?..... /etc/sysconfig/rkhunter
..?..... /usr/bin/rkhunter
missing /usr/lib/rkhunter/scripts/check_modules.pl
missing /usr/lib/rkhunter/scripts/check_port.pl
missing /usr/lib/rkhunter/scripts/check_update.sh
missing /usr/lib/rkhunter/scripts/filehashmd5.pl
missing /usr/lib/rkhunter/scripts/filehashsha1.pl
missing /usr/lib/rkhunter/scripts/showfiles.pl
missing /var/rkhunter/db/backdoorports.dat
missing /var/rkhunter/db/defaulthashes.dat
missing /var/rkhunter/db/md5blacklist.dat
missing /var/rkhunter/db/mirrors.dat
missing /var/rkhunter/db/os.dat
missing /var/rkhunter/db/programs_bad.dat
missing /var/rkhunter/db/programs_good.dat
Is this a updating problem of rkhunter itself? Or some rootkits kill it?
I've never install rkhunter from a RPM, I always use it from a tarball.
By the way, I've not found out that problems in normal situation. So, maybe
you should check your logs in order to see if someone broke into your box.
When I use rkhunter or other rootkit-detector I'm used to install it on a no
default path, maybe this way rootkits won't be able to delete any file either
trojanized one.
Greetings.
--
Manuel Arostegui Ramirez.
Electronic Mail is not secure, may not be read every day, and should not
be used for urgent or sensitive issues.