Subject: Re: ports chkrootkit wrongly says login is INFECTED
To: None <netbsd-users@netbsd.org>
From: Jeremy C. Reed <reed@reedmedia.net>
List: netbsd-users
Date: 03/01/2005 08:54:51
On Tue, 1 Mar 2005, David Maxwell wrote:
> I believe this has come up before, and was due to a bug in chkrootkit.
> It had some expectation of the behaviour of a command line utility - and
> its expectation caused a broken pipeline, which results in an incorrect
> result.
It is in the September 2004 port-i386 archives.
chkrootkit 0.44 changes indicate the problem was fixed, but it was not
according to a message on tech-pkg in December.
chkrootkit 0.45 is now available. Maybe it fixes the problem.
I have also used rootkithunter (rkhunter) several times. But I don't think
it is pkgsrc yet. (I have old patches from September.)
Jeremy C. Reed
BSD News, BSD tutorials, BSD links
http://www.bsdnewsletter.com/