Re: [Rkhunter-users] feedback for Dick - unhide stops box

2007-12-06 Thread unspawn
On Wed, 05 Dec 2007 23:29:00 +0100 Dick Gevers [EMAIL PROTECTED] wrote: On Mon, 26 Nov 2007 18:50:33 +, Dick Gevers wrote about Re: For anyone interested: it was indeed a kernel bug, discovered due to use of unhide and is now fixed. Thanks for dealing with this problem! Best regards,

Re: [Rkhunter-users] test of embedded RKH in live cd FYI only

2007-12-06 Thread Nils Breunese (Lemonbit)
Gordy wrote: Thanks for the accuracy and amount of feedback on the issue I raised earlier. But I confess I should have read the man page more closely as you already mentioned the r switch. I may get around to write a mini howto but to refreshmy last email stated My objective is to

[Rkhunter-users] baffling warning

2007-12-06 Thread Dick Gevers
I've been meaning to ask this since rkh 1.3.0 came out, but never got around to it. When one of the checked binaries changes, obviously a warning appears, which goes away if I run rkh with '--propupd'. There's one set of exceptions: [23:50:37] /bin/rpm [

Re: [Rkhunter-users] baffling warning

2007-12-06 Thread John Horne
On Thu, 2007-12-06 at 17:49 +, Dick Gevers wrote: I've been meaning to ask this since rkh 1.3.0 came out, but never got around to it. When one of the checked binaries changes, obviously a warning appears, which goes away if I run rkh with '--propupd'. There's one set of exceptions:

Re: [Rkhunter-users] Questionable improvement

2007-12-06 Thread Dave
John Horne wrote: On Thu, 2007-12-06 at 23:50 +0800, Uwe Dippel wrote: Please, please bring back a default mail pointing to the reason for the warning ! I'm a bit lost with this. What was the default mail that you used to receive before? Have you used the '--report-warnings-only' option?

Re: [Rkhunter-users] Questionable improvement

2007-12-06 Thread John Horne
On Fri, 2007-12-07 at 09:22 +1100, Dave wrote: John Horne wrote: On Thu, 2007-12-06 at 23:50 +0800, Uwe Dippel wrote: Please, please bring back a default mail pointing to the reason for the warning ! I'm a bit lost with this. What was the default mail that you used to receive before?

Re: [Rkhunter-users] baffling warning

2007-12-06 Thread Dick Gevers
On Thu, 06 Dec 2007 21:42:53 +, John Horne wrote about Re: [Rkhunter-users] baffling warning: Hmm, this doesn't make much sense. The warnings are caused by the RPM package manager saying that the files are NOT correct. Yes, but the rpmdb changes when packages are upgraded. So rkh needs a new

Re: [Rkhunter-users] baffling warning

2007-12-06 Thread Nils Breunese (Lemonbit)
Dick Gevers wrote: On Thu, 06 Dec 2007 21:42:53 +, John Horne wrote about Re: [Rkhunter-users] baffling warning: Can you run 'rpm -Vf /usr/bin/who' and let me know what the output is (if any) please. Of course: # rpm -Vf /usr/bin/who S.5T c /etc/DIR_COLORS S.5T c /etc/pam.d/su

Re: [Rkhunter-users] baffling warning

2007-12-06 Thread Dick Gevers
On Fri, 7 Dec 2007 00:15:32 +0100, Nils Breunese (Lemonbit) wrote about Re: [Rkhunter-users] baffling warning: Of course: # rpm -Vf /usr/bin/who S.5T c /etc/DIR_COLORS S.5T c /etc/pam.d/su .MG./usr/bin/who Looks okay to me. But I'll appreciate any ideas. For the first

Re: [Rkhunter-users] baffling warning

2007-12-06 Thread John Horne
On Thu, 2007-12-06 at 23:01 +, Dick Gevers wrote: On Thu, 06 Dec 2007 21:42:53 +, John Horne wrote about Re: [Rkhunter-users] baffling warning: Hmm, this doesn't make much sense. The warnings are caused by the RPM package manager saying that the files are NOT correct. Yes, but the

Re: [Rkhunter-users] baffling warning

2007-12-06 Thread Dick Gevers
On Thu, 06 Dec 2007 23:57:05 +, John Horne wrote about Re: [Rkhunter-users] baffling warning: If you look at the 'rpm' man page, under the verification section it will tell you what the various letters mean. For the 'who' file the mode/permissions and group ownership have changed from what