On Saturday 11 May 2002 09:19 am, Daniel Stiefel wrote:
> A few days ago, I got some KWrited docs popping up on my Mandrake 8.1
> desktop ("Security warning: World Writeable files found" followed by a long
> list of files located on both hardrives). I am a linux newbie and assumed
> the popups were the product of some kind of monitoring utility that I had
> inadvertently installed.
>
> Although I have a simple workstation setup (except for the extra partitions
> and triple boot aspect to it) and installed 8.1 with medium security, I
> went back into the control panel and re-set it to medium security and the
> Kwrited popups stopped appearing.
>
> From the lists of files displayed, I assumed my machine had been
> compromised and that I would have to partition, reformat, reload the win98,
> mandrake 8.1 and Redhat 5.1 partition in order to make things right. I
> downloaded chkrootkit and ran it while booted to the main HD/ Mandrake 8.1
> just to see what was up. Surprisingly it showed nothing. I'm not sure why
> that is. I am not familiar with chkrootkit and may have failed to run it
> so that it searched all of the drives.
>
> Can anyone tell me how to run it to seach RH 5.1 or the win98SE partition?
> Can that be done from 8.1 on the other drive as I attempted? Does it check
> comprehensively or does it only check the drive/OS that it is booted to?
>
> Secondly, is it possible that, despite the KWrited popops that occured on 2
> different occasions, my machine is unnaffected?
>
> dan
This is one of the checks performed by MSec. World writeable refers to the
permissions. When you import a file from windows it's permissions have to be
reset and possibly the ownership.
man chmod
man chown
http://www.linux-mandrake.com/en/doc/82/en/ref.html/prog-msec.html
should get you started.
For files that are not executables try 0640. Files from windows are probably
0777.
Michael
Want to buy your Pack or Services from MandrakeSoft?
Go to http://www.mandrakestore.com
