rkhunter warning after updating
Andy Blanchard
zocalo at gmail.com
Mon Nov 30 22:24:11 UTC 2009
2009/11/30 Kevin Fenzi <kevin at scrye.com>:
> Disable the application checks. I am going to likely push out a new
> rkhunter package that does this soon.
>
> The problem is that upstream pushes out a dat file with the versions of
> those packages that are up to date and proof against known security
> issues. Fedora often backports fixes for stable releases, so the
> version isn't very good as an indicator when you are safe or not.
I'm not sure that disabling the application checks is the best
approach. There is a mechanism in "rkhunter.conf" to whitelist
specific applications (APP_WHITELIST), either by name or name and
version. I'd rather know about it when things change, so I've put the
version numbers in as well since it's a quick update if and when
Fedora updates the release instead of back-porting patches. The line
in my "rkhunter.conf" on F11 is as follows:
APP_WHITELIST="gpg:1.4.0 httpd:2.2.13 named:9.6.1 sshd:5.2p1"
You'd need to adapt the version numbers per Fedora release of course
(or forego them entirely) but IMHO it's still preferable to disabling
the application checks entirely.
--
Andy
The only person to have all his work done by Friday was Robinson Crusoe
More information about the fedora-list
mailing list