On Thu, 2006-09-14 at 10:44 +0100, John Horne wrote:
Warning: This operating system is not fully supported!
Warning: Cannot find md5_not_known
could be that.
No, this doesn't set the warning variable in the code (at least that I
can see!).
Oops, my mistake. The warning messages
On Sun, 2006-10-01 at 02:43 +0300, Nerijus Baliunas wrote:
On Sun, 01 Oct 2006 00:17:24 +0100 John Horne [EMAIL PROTECTED] wrote:
No. From the sourceforge site, download the 'hashupd.sh' script and run
that.
I ran rkhunter --update, but it says all mirrors I tried are out of date.
I
it, but could perhaps try and find out. The second option is
probably the easiest.
Anyone have any comments about this?
Thanks,
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax
this.
=
It may be that you need to leave SELinux disabled will RKH runs.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Using Tomcat but need to do more? Need to support
On Mon, 2006-10-16 at 10:41 +0100, Dave R wrote:
Rootkit Hunter 1.2.8 is running
Suggest you upgrade to 1.2.9 as well.
(Your '--update' worked because the data files are aware of Centos 4.)
John.
--
---
John Horne
...
Application not found
$ which ssh
/usr/bin/ssh
The test looks for sshd, not ssh, since that is what will decide if
someone can access your system or not.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E
On Sun, 2006-11-12 at 20:52 +, Dick Gevers wrote:
On Sun, 12 Nov 2006 20:45:35 +, John Horne wrote about Re:
[Rkhunter-users] Unkown application versions..:
On Sun, 2006-11-12 at 20:36 +, Dick Gevers wrote:
On Sun, 12 Nov 2006 20:02:12 +0100, Jacob Willig wrote about
[Rkhunter
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take Surveys. Earn Cash. Influence the Future of IT
Join
this as a bug on the sourceforge web page please.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
that. It will update your local os.dat file with the current hashes.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
On Fri, 2006-12-08 at 11:57 -0700, JT Moree wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
John Horne wrote:
On Thu, 2006-11-30 at 14:19 -0700, JT Moree wrote:
I have rkhunter running on a system where I get a warning email even
though when I run the report nothing seems
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take Surveys. Earn Cash. Influence the Future of IT
Join
you
what options are available.
Note, references in the logfile to '-- hashupd' should of course be
'--hashupd'.
Step 3 is an installer bug. Oops.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail
the hostname in the subject for the mail-on-warnings
setting. The log file also includes the hostname at the top (if a
hostname has been set).
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL
, then restart sshd.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take
have
mentioned that.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take
that by default
the current colour set (red/yellow/green) will still be used, so users
won't notice a difference unless they specify to use the second colour
set.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E
the file
hashes. I would suggest you modify your os.dat file to make the first
line something like 'version=00', and then run 'rkhunter
--update' to get the latest version.
John.
--
---
John Horne, University of Plymouth, UK
then get
missed :-)
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take
installation didn't complete successfully
or had some problem causing SElinux to fail.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
' will be performed first to ensure the latest files are being
used. The current release does it the other wrong way round - the system
check first and then it updates the files.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay
.
I have just checked the file on sourceforge and it looks fine:
{john}28: cat mirrors.dat
version=2006121200
mirror=http://rkhunter.sourceforge.net
mirror=http://rkhunter.sourceforge.net
John.
--
---
John Horne
to getting that all elusive next
release out to you people :-)
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
that something has
changed.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take Surveys. Earn Cash. Influence the Future of IT
Join
.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Take Surveys. Earn Cash
On Sat, 2007-01-13 at 17:04 +, John Horne wrote:
On Sat, 2007-01-13 at 10:38 -0600, Mike Blezien wrote:
Hello John,
after running the following:
-
$ rpm -Vf /bin/more
# OUTPUT
.M../bin/mount
.M../bin/umount
.M../usr/bin/chfn
On Tue, 2007-01-23 at 19:02 +, Dick Gevers wrote:
On Tue, 23 Jan 2007 10:37:48 +, John Horne wrote about Re:
[Rkhunter-users] CRON warning:
On Tue, 2007-01-23 at 07:45 +, steve wrote:
Hello,
Can anyone tell me what this means, the SME e-mail server gives this
error
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done
above ('ps' options), it starts to get a bit messy.
That's my thinking anyway :-)
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
The hash value I have is:
b442c1a332746a7c40767aa587a5ca8a rkhunter-1.2.9.tar.gz
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
Apache, but not changed the
version number. Hence, the check does not really help the user.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download DB2
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE
until I can sort it out.
Good news is that the next release makes things easier - only one
version number used per '.dat' file, so it just compares that against
your running version.
John.
--
---
John Horne, University of Plymouth, UK
Hello,
The '--update' option is now working again. I have updated the files on
sourceforge (about 5 mins ago), and run RKH '--update' locally twice. If
anyone wants to know, the new version number is 2007050201.
John.
--
---
John
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE
it is a shell script running other binary programs. Lsof
may be the cause.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download
,
rather than you having to keep emailing individuals. Probably best if
you put it in as a 'support request'.
I would be interested to see if there is anything we can easily/quickly
do for the next release.
Thanks,
John.
--
---
John
out better).
For the moment though, as already suggested, you may have to use the
--nocolors option.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
which doesn't run
the hash checks if it doesn't know the O/S).
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
As what?
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2
installation is done).
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored
, the second one is
the current SHA1 value for the corrected tarball.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
Overall I think it should be possible :-)
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2
it and
there are bugs, well hopefully they won't be too bad :-) Don't forget,
of course, to report them!
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
it doesn't seem worth testing.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
to do, but I
suspect testing would be easier if a list were provided.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version
installation.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net
, rkhunter
knows nothing about RPM verification.
The first 8 '.' refer to the various file properties. I don't know what
the 'C' is and my FC3 system gives no indication of what that is either.
John.
--
---
John Horne, University of Plymouth
it to
'PermitRootLogin no', unless you have some specific reason for allowing
root logins.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
a default installation.
Did you change the rkhunter.conf file after installation, in particular
the 'DBDIR' entry?
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752
On Mon, 2007-07-23 at 15:33 +0200, andre piewak wrote:
[14:26:18] Checking if SSH root access is allowed [ Warning ]
The log file will contain the reason for this warning. You haven't shown
us that bit.
John.
--
---
John Horne
script look like? It is now perfectly possible to
combine updates with a check (using '--update -c --cronjob'), but if you
are running the update seperately then RKH assumes colours will be used
for the output.
John.
--
---
John Horne
-q
/usr/local/bin/rkhunter --update -q
/usr/local/bin/rkhunter --cronjob --rwo
You can, if you want, check the return code when '-q' is used to see if
everything went okay.
John.
--
---
John Horne, University of Plymouth, UK Tel
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk
look in the log file to see why you have been
given warnings. Then look in the rkhunter.conf file to see if the
entries can be whitelisted (assuming they are valid).
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752
that.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email
. an '*-version' file is found but it is nothing
to do with the operating system. I think it was felt better to not do
this, and for users to let us know if their O/S was not recognised.
John.
--
---
John Horne, University of Plymouth, UK Tel
On Thu, 2007-08-16 at 23:41 +0200, [EMAIL PROTECTED] wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512
John Horne wrote:
On Thu, 2007-08-16 at 22:25 +0200, [EMAIL PROTECTED] wrote:
What I have in /etc/ssh/sshd_config is this (hexdump, output rewrapped):
*** quote (start
On Thu, 2007-08-16 at 23:41 +0200, [EMAIL PROTECTED] wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512
John Horne wrote:
On Thu, 2007-08-16 at 22:25 +0200, [EMAIL PROTECTED] wrote:
What I have in /etc/ssh/sshd_config is this (hexdump, output rewrapped):
*** quote (start
of whitelisting ports that are known to
be in use, or ports (which may vary) that are in use by a known process
(requires lsof for this). I would suggest either waiting for the full
release or test the beta, or CVS, version.
John.
--
---
John
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk Inc.
Still
-properties check.
I would suggest looking through the log file to see why the warnings
occur. Then perhaps look through the configuration file to see if there
is any whitelisting available for the reasons given.
John.
--
---
John Horne
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk Inc.
Still
yourself if you wish. Hence
the 'please double-check' message.
Does that help?
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Microsoft
Defy all challenges
the sourceforge site. Alternatively try the 1.3.0 beta 2 version
(and read the README file about installation).
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0
.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email
is to check the
return code instead. It will be non-zero if something has occurred - the
README has more details about the return code.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED
/mirrors.dat
Does running the wget command manually from the command-line work?
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
rkhunter.sourceforge.net 80
Trying 66.35.250.209...
Connected to rkhunter.sourceforge.net.
Escape character is '^]'.
^]
telnet quit
Connection closed.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored
there though, and have reported the name
as '# root'.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual
, the file please.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net
will show you how to do this).
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
the
processes, /usr/local/apache/bin/httpd and /usr/bin/perl, have file
descriptors open for files which no longer exist, which is suspicious.
Look for ALLOWPROCDELFILE in the config file to see about whitelisting.
John.
--
---
John
On Thu, 2007-09-27 at 09:55 -0500, Mike Blezien wrote:
John,
- Original Message -
From: John Horne [EMAIL PROTECTED]
To: RkhunerList rkhunter-users@lists.sourceforge.net
Sent: Thursday, September 27, 2007 9:10 AM
Subject: Re: [Rkhunter-users] Another Warnings question
On Thu
On Thu, 2007-09-27 at 10:46 -0500, Mike Blezien wrote:
John,
- Original Message -
From: John Horne [EMAIL PROTECTED]
To: RkhunerList rkhunter-users@lists.sourceforge.net
Sent: Thursday, September 27, 2007 10:13 AM
Subject: Re: [Rkhunter-users] Another Warnings question
called 'USING TEST NAMES' which
explains about enabling and disabling tests.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R
On Tue, 2007-10-02 at 17:54 +0100, John Horne wrote:
On Sun, 2007-09-30 at 22:59 -0400, Mark Misulich wrote:
Hi,
I started out using rkhunter version 1.2.8, then upgraded to 1.2.9 a few
weeks ago. I wasn't able to get 1.2.9 to update after I installed it,
but it would check for rootkits
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files
version of RKH. I would say first of all upgrade.
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
On Tue, 2007-10-09 at 11:40 +0200, Nils Breunese (Lemonbit) wrote:
John Horne wrote:
On Mon, 2007-10-08 at 13:43 +0300, Pacala Jr wrote:
I am using your tool on an Linux Debian setup with openvz
Unfortunately your product doesn't recognize openvz
Any plans/dates to support openvz
it saying that the latest version is less
than your running version.
Regards,
John.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk Inc
, you only want to see any warning messages then look at the
'--report-warnings-only' option (in the man page or just type 'rkhunter
-h').
Note, I have removed the ' echo ' you had because it was
unnecessary.
John.
--
---
John Horne
.
--
---
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files
1 - 100 of 627 matches
Mail list logo
