The first 2 are that egrep and fgrep are shell scripts instead of sym-links to
grep. This maybe on purpose in Ubuntu, I don’t know. I’m a CentOS guy.
But you should look at them. Are they from Ubuntu, or are they a break in
attempt.
The rest are the desktop processes, they use a lot of memory. Rkhunter is kind
of expecting to be run on a server not a desktop. There is probably a way to
get it to ignore those processes. I get something similar occasionally when
someone starts up a Firefox. I just ignore it.
From: Robert Hare <r.hare0...@gmail.com>
Sent: Monday, January 07, 2019 11:12 AM
To: rkhunter-users@lists.sourceforge.net
Subject: [Rkhunter-users] Error messages
Hi folks,
Sorry if I'm wrong in emailing you, but I've forgotten how to
raise a question.
I have just installed rkhunter 1.4.6 on Ubuntu 18.04 (bionic
Beaver). I am using GNOME Flashback (Metacity) as my desktop. I am getting 2
sets of errors and I'm wondering if they are real errors, or can I white-list
them. They are:-
/bin/egrep [ Warning ]
[16:30:25] Warning: The command '/bin/egrep' has been replaced by a script:
/bin/egrep: POSIX shell script, ASCII text executable
[16:30:25] /bin/fgrep [ Warning ]
[16:30:25] Warning: The command '/bin/fgrep' has been replaced by a script:
/bin/fgrep: POSIX shell script, ASCII text executable
and
Checking for suspicious (large) shared memory segments [ Warning ]
[16:31:22] Warning: The following suspicious (large) shared memory segments
have been found:
[16:31:22] Process: /usr/bin/nautilus-desktop PID: 1839 Owner:
sysprog Size: 64MB (configured size allowed: 1.0MB)
[16:31:22] Process: /usr/bin/nautilus-desktop PID: 1839 Owner:
sysprog Size: 16MB (configured size allowed: 1.0MB)
[16:31:22] Process: /usr/lib/gnome-terminal/gnome-terminal-server
PID: 2072 Owner: sysprog Size: 4.0MB (configured size allowed: 1.0MB)
Bob Hare.
This communication is the property of CenturyLink and may contain confidential
or privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful. If you have received this communication in
error, please immediately notify the sender by reply e-mail and destroy all
copies of the communication and any attachments.
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
