On Mon, 2007-09-24 at 13:15 +0200, Erik RSCALOVER wrote: > hi folks, > > RkHunter 1.3.0 gives me false warnings like > > Warning: The command '/usr/bin/GET' has been replaced by a > script: /usr/bin/GET: perl script text executable > Warning: The command '/usr/bin/groups' has been replaced by a > script: /usr/bin/groups: Bourne shell script text executable > Warning: The command '/usr/bin/ldd' has been replaced by a > script: /usr/bin/ldd: Bourne shell script text executable > Warning: The command '/usr/bin/whatis' has been replaced by a > script: /usr/bin/whatis: Bourne shell script text executable > Warning: The command '/sbin/ifdown' has been replaced by a > script: /sbin/ifdown: Bourne-Again shell script text executable > Warning: The command '/sbin/ifup' has been replaced by a > script: /sbin/ifup: Bourne-Again shell script text executable > Look in the configuration file, known scripts can be whitelisted. The test is to see if a binary command has been replaced by a script, but valid scripts have to be whitelisted.
John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839 ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
