rkhunter Question.

[Gene Heskett]

On Thursday 08 January 2009, John Horne wrote:
>On Thu, 2009-01-08 at 16:42 +0000, John Horne wrote:
>> On Thu, 2009-01-08 at 09:38 -0500, Gene Heskett wrote:
>> > They say a little paranoia is a good thing, so I installed the rkhunter
>> > rpm, which in turn apparently sets itself up as a cron job.
>> >
>> > I got emails from it bitching about a couple of perfectly legit files,
>> > and I found out where to whitelist them, so that warning is gone.  While
>> > I was at it I enabled another set of tests that weren't by default, the
>> > additional_rkts.
>> >
>> > Now it is complaining about the lack of copies for passwd and group, but
>> > they do exist as name- files.  Is this a foible of rkhunter, or a
>> > redhatism?
>> >
>> > Recommended fix?
>>
>> Do nothing. When rkhunter is first run it has no copy of the
>> passwd/group files to check against for changes. Hence the warning. As
>> it runs, it will take a copy. When it runs again, it then has a copy, so
>> the warning goes away.
>
>Hmm, actually thinking about it the rkhunter.spec file specifies to
>install copies of the files when the rpm is installed. As such the error
>should not have occurred. May want to raise that with the packager of
>the rpm (i.e. report it via the fedora bugzilla).
>
If they previously exist as name- files due to being edited with vim, they 
apparently are not over written.  Each was a generation old, not containing 
my latest additions.  I have over written them now & we'll see.

Should the rpm installer have over written them?  I dunno, there could be 
problems intro'd either way in this case.

Thanks John.

-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
You have the body of a 19 year old.  Please return it before it gets wrinkled.