Re: /usr/bin/whatis replaced by a script (correct?)
On Tue, 2007-11-06 at 17:54 +0100, Peo Nilsson wrote: On Mon, 2007-11-05 at 22:31 -0500, Lowell Gilbert wrote: Peo Nilsson [EMAIL PROTECTED] writes: When running rkhunter 1.3.0 I get those warnings: ...snip /usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable They aren't replaced. They are all *supposed* to be scripts. Thanks for the info. After knowing this, I edited rkhunter.conf like this: RTKT_FILE_WHITELIST=/usr/bin/whatis /usr/sbin/adduser /usr/local/bin/GET /usr/local/sbin/pkgdb When running 'rkhunter -c' I still get the same warnings as before... What am I missing? Solved, but many thanks anyway. I should have set SCRIPTWHITELIST insteed of RTKT_FILE_WHITELIST, wich I did first. -- /Peo -- - PGP signed/encrypted emails is prefered - -- signature.asc Description: This is a digitally signed message part
Re: /usr/bin/whatis replaced by a script (correct?)
Peo Nilsson [EMAIL PROTECTED] writes: When running rkhunter 1.3.0 I get those warnings: ...snip /usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable /usr/sbin/adduser' has been replaced by a script: /usr/sbin/addu ser: Bourne shell script text executable /usr/local/bin/GET' has been replaced by a script: /usr/local/bi n/GET: perl script text '/usr/local/sbin/pkgdb' has been replaced by a script: /usr/local /sbin/pkgdb: a /usr/local/bin/ruby18 script text executable snip... Are those programs supposed to be replaced like this ? I'm running FreeBSD 6.2 Release-p7 with ports up to date. They aren't replaced. They are all *supposed* to be scripts. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: /usr/bin/whatis replaced by a script (correct?)
On Mon, 2007-11-05 at 22:31 -0500, Lowell Gilbert wrote: Peo Nilsson [EMAIL PROTECTED] writes: When running rkhunter 1.3.0 I get those warnings: ...snip /usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable They aren't replaced. They are all *supposed* to be scripts. Thanks for the info. After knowing this, I edited rkhunter.conf like this: RTKT_FILE_WHITELIST=/usr/bin/whatis /usr/sbin/adduser /usr/local/bin/GET /usr/local/sbin/pkgdb When running 'rkhunter -c' I still get the same warnings as before... What am I missing? -- /Peo signature.asc Description: This is a digitally signed message part
