Subject: Re: Chkrootkit 0.44
To: Adrian Portelli <adrianp@stindustries.net>
From: David Maxwell <david@crlf.net>
List: port-i386
Date: 09/14/2004 11:40:09
On Tue, 14 Sep 2004, Adrian Portelli wrote:
> "sh -x chkrootkit" gives this on a stock 1.6.2 box (with security patches):
>
> + [ NetBSD = FreeBSD -o NetBSD = NetBSD -o NetBSD = OpenBSD -a 1 0 -eq 1 ]
^^^^^^^^^^
Yup. That's not a valid expression.
> [: 0: unexpected operator
> + STATUS=0
> + /usr/bin/strings+ /usr/bin/egrep -a
> vejeta|xlogin|^@\(#\)klogin\.c|lets_log|sukasuka|/usr/lib/.ark?|SucKIT
> /usr/bin/login
>
> + return 0
> + STATUS=0
> + [ = t ]
> + echo INFECTED
> INFECTED
>
> Problem with the script ?
--
David Maxwell, david@vex.net|david@maxwell.net --> From a real request to a
helpdesk "Can you please open the following ports in the firewall: 1024-90000"
- Anonymous to protect the guilty