rkhunter

[Colin J Thomson]

Hi,

On Tuesday 14 March 2006 03:50, François Patte wrote:

> Just update rkhunter to rkhunter-1.2.8-1.fc4 and now it bores me with
> mails:
>
> "Please inspect this machine, because it can be infected"
>
> Ok! I just run rkhunter manually: absolutely no warning!!!!
>
> I checked with chkrootkit : no warning....

rkhunter is complaining about /dev/.udevdb and /usr/share/man/man1/..1.gz 
early versions just used to give you a warning to inspect these DIR's.

in /etc/rkhunter.conf uncomment these lines:
ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
ALLOWHIDDENDIR=/dev/.udevdb

HTH

-Colin
-- 
Fedora Core 4, Custom Built Kernel 2.6.15-ck7
KDE-Redhat-3.5.1-2.4.fc4.kde
Registered Linux user number #342953