On Tue, 2007-09-11 at 13:25 -0400, Brian McKee wrote: > On 11-Sep-07, at 12:33 PM, <[EMAIL PROTECTED]> wrote: > > > On Tue, 11 Sep 2007 18:17:23 +0200 Brian McKee <[EMAIL PROTECTED]> > > wrote: > > > >> Here's an interesting tidbit. I installed Parallels (similar to > >> VMware) on OSX where I had rkhunter 1.2.9 running, and it flagged > >> one of the virtual network cards as 'promiscuous' > > > > But was it? > > Any details you want to share? > > How about testing 1.3.0 if you have time to spare? > > > > Well, 1.3 is on my list of things to try, but I'm swamped currently.... > > As for whether it's 'promiscuous' or not, OSX seems to think it is, > so I guess rkhunter is 'right' > I had someone check a couple of our Vmware ESX servers here, and none of the interfaces are in promiscuous mode. As such, I would not have thought that running the interfaces in promiscuous mode was a virtualisation thing (i.e. required for it to work).
With version 1.3.0 you can disable just the promiscuous interfaces check (see DISABLE_TESTS in the config file). That way you can run RKH without it giving you the same warning all the time. However, it has obvious security problems in that none of the interfaces would be checked. John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839 ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
