Package: tiger
Version: 1:3.2.1-26
Severity: wishlist
Tiger calls "chkrootkit -q" in /usr/lib/tiger/scripts/check_rootkit.
n my case this is very slow because it scans NFS directories.
I would like to have a configuration variable in /etc/tiger/tigerrc
which can be set to add option "-n" to the chkrootkit command.
In chkrootkit this would add options to some find commands to skip
NFS directories.
proposal 1:
Add a specific variable
Tiger_CHKROOTKIT_SKIP_NFS={Y|N}
which is used in /usr/lib/tiger/scripts/check_rootkit to add
option -n to the CHKROOTKIT command or not.
proposal 2:
Add a more general variable
Tiger_CHKROOTKIT_ARGS
which is inserted into the CHKROOTKIT command after option -q.
With the 2nd solution I could set Tiger_CHKROOTKIT_ARGS='-n'
to get what I want. It would also be possible to use this variable
to select a set of tests to be performed by chkrootkit like this:
Tiger_CHKROOTKIT_ARGS="aliens asp bindshell lkm rexedcs"
Bodo
-- System Information:
Debian Release: testing/unstable
APT prefers testing
APT policy: (900, 'testing'), (500, 'stable'), (300, 'unstable'), (10,
'experimental')
Architecture: i386 (i586)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.4.27-2-k6
Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15)
Versions of packages tiger depends on:
ii binutils 2.16.1-2 The GNU assembler, linker and bina
ii coreutils [fileutils] 5.2.1-2 The GNU core utilities
ii debconf 1.4.52 Debian configuration management sy
ii diff 2.8.1-11 File comparison utilities
ii fileutils 5.2.1-2 The GNU file management utilities
ii libc6 2.3.2.ds1-22 GNU C Library: Shared libraries an
ii net-tools 1.60-15 The NET-3 networking toolkit
Versions of packages tiger recommends:
ii binutils 2.16.1-2 The GNU assembler, linker and bina
ii chkrootkit 0.45-1 Checks for signs of rootkits on th
ii exim [mail-transport-agent] 3.36-17 An MTA (Mail Transport Agent)
pn john <none> (no description available)
-- debconf information:
* tiger/mail_rcpt: root
tiger/remove_mess: true
* tiger/policy_adapt:
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
