Subject: Re: ports chkrootkit wrongly says login is INFECTED
To: None <netbsd-users@netbsd.org>
From: Jeremy C. Reed <reed@reedmedia.net>
List: netbsd-users
Date: 03/01/2005 08:54:51
On Tue, 1 Mar 2005, David Maxwell wrote:

> I believe this has come up before, and was due to a bug in chkrootkit.
> It had some expectation of the behaviour of a command line utility - and
> its expectation caused a broken pipeline, which results in an incorrect
> result.

It is in the September 2004 port-i386 archives.

chkrootkit 0.44 changes indicate the problem was fixed, but it was not
according to a message on tech-pkg in December.

chkrootkit 0.45 is now available. Maybe it fixes the problem.

I have also used rootkithunter (rkhunter) several times. But I don't think
it is pkgsrc yet. (I have old patches from September.)



 Jeremy C. Reed

 	  	 	 BSD News, BSD tutorials, BSD links
	  	 	 http://www.bsdnewsletter.com/