On Wed, 2011-07-20 at 11:51 +0100, John Horne wrote: > On Wed, 2011-07-20 at 11:37 +0100, Arthur Dent wrote: > > Hello All, > > > > I have a couple of Java applications running on this machine. A bit of > > googling has shown me that when they run they create a file called > > hsperfdata_{USER}/{NUMBER} which apparently helps with performance > > somehow. The location of this file is (again, apparently) hard-coded > > as /tmp/. > > > > RKHunter doesn't like these files. > > > > Warning: File '/tmp/hsperfdata_root/954' (score: 230) contains some > > suspicious content and should be checked. > > Warning: File '/tmp/hsperfdata_root/954' (score: 230) contains some > > suspicious content and should be checked. > > > > Note that the same file is reported twice for some reason... > > > > So how best to deal with these? > > > I don't think you can. The warnings come from the 'suspscan' test which > is not enabled by default because it is cpu intensive and may produce > false-positives. There is no mechanism (that I can think of) for > whitelisting entries from that test. > > You could, of course, disable the test. Alternatively you could set the > maximum threshold score below 230, but that may well lead to other > suspicious files not being detected. >
OK John, I was afraid of that... So - live with it then... Thanks for your help. Much appreciated. Mark
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ 10 Tips for Better Web Security Learn 10 ways to better secure your business today. Topics covered include: Web security, SSL, hacker attacks & Denial of Service (DoS), private keys, security Microsoft Exchange, secure Instant Messaging, and much more. http://www.accelacomm.com/jaw/sfnl/114/51426210/
_______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users