Hi Paul, > I have not added any packages in several days but chkroot reports some new > Perl files. Anybody out there with more experience understand what's > happening here?
> Searching for suspicious files and dirs, it may take a while... > /usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist > /usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist >/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist > /usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist > /usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist > /usr/lib/perl5/5.00503/i386-linux/.packlist Each time a Perl module is installed such a .packlist is generated and it contains a list of all files and folders associated with that package. That makes it easier for people to build RPMs with those modules and helps when someone wants to delete a PERL module and all associated files. The modules mod_perl, MD5, Quota, XML::Parser and Devel::Symdump are usually installed on a RaQ, so this report is nothing to worry about. If out of the sudden additional Perl modules appear and you didn't install 'em, then you can start to worry. :o) These .packlist files which are presently on your system will always get reported by Chkrootkit. You could as well go ahead and delete 'em to stop those reports. -- With best regards, Michael Stauber [EMAIL PROTECTED] Unix/Linux Support Engineer _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
