On Thu, 2009-12-17 at 01:07 +0100, Roberto Garcia wrote: > This is the output: > lsattr: Inappropriate ioctl for device While reading flags > on /etc/rkhunter.conf > Which is an error, so RKH states that there is no (correct) output from the command.
> I have found the diference, on the RHEL 5.4 machine we have a symbolic > link to rkhunter.conf. this is the problem the link. > do you know any solution? > Why have a link? With RKH 1.3.6 you can put any local changes into a '/etc/rkhunter.conf.local' file. That way no changes need to be made to /etc/rkhunter.conf at all. (If that is in some way the reason for the link.) However, if there must be a link, then you can disable this specific test. Either copy/paste the default DISABLE_TESTS option from /etc/rkhunter.conf into /etc/rkhunter.conf.local, or modify the /etc/rkhunter.conf itself. In either case add the test name 'immutable' to the list of disabled tests. I will make a note, however, that additional testing of lsattr could be used in order to determine if it is actually available for use or not. John. -- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001 ------------------------------------------------------------------------------ This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers http://p.sf.net/sfu/verizon-dev2dev _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
