Hi Peter, These are false positives for sure. I will make sure to fix it for the next version.
Thanks for letting us know. *if you can, please open a bug about it at: http://www.ossec.net/bugs/ -- Daniel B. Cid dcid ( at ) ossec.net On Nov 3, 2007 11:09 AM, Peter M. Abraham <[EMAIL PROTECTED]> wrote: > > Greetings: > > CentOS 5 uses /dev/.udev/ > > I believe the following are false positives: > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@device-mapper' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda2' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda1' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda3' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda7' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda6' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda8' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda5' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@sda4' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]' present on /dev. Possible > hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@[EMAIL PROTECTED]' present > on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]' present on /dev. Possible > hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@usbdev3.1' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@usbdev2.1' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@usbdev4.1' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@usbdev1.1' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]' present on /dev. Possible > hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@usbdev4.3' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]' present on /dev. Possible > hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@usbdev2.3' present on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@[EMAIL PROTECTED]' present > on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@[EMAIL PROTECTED]' present > on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@[EMAIL PROTECTED]' present > on / > dev. Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@msr1' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@mice' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@msr0' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@cpu0' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/db/[EMAIL PROTECTED]@cpu1' present on /dev. > Possible hidden file. > > [FAILED]: File '/dev/.udev/uevent_seqnum' present on /dev. Possible > hidden file. > > If these are false positives, please fix in the next version of ossec- > rootcheck > > Thank you. > >
