rkhunter Question.

[Gene Heskett]

On Thursday 08 January 2009, John Horne wrote:
>On Thu, 2009-01-08 at 15:22 -0500, Gene Heskett wrote:
>> On Thursday 08 January 2009, John Horne wrote:
>> >On Thu, 2009-01-08 at 16:42 +0000, John Horne wrote:
>> >> On Thu, 2009-01-08 at 09:38 -0500, Gene Heskett wrote:
>> >> > They say a little paranoia is a good thing, so I installed the
>> >> > rkhunter rpm, which in turn apparently sets itself up as a cron job.
>> >> >
>> >> > I got emails from it bitching about a couple of perfectly legit
>> >> > files, and I found out where to whitelist them, so that warning is
>> >> > gone.  While I was at it I enabled another set of tests that weren't
>> >> > by default, the additional_rkts.
>> >> >
>> >> > Now it is complaining about the lack of copies for passwd and group,
>> >> > but they do exist as name- files.  Is this a foible of rkhunter, or a
>> >> > redhatism?
>> >> >
>> >> > Recommended fix?
>> >>
>> >> Do nothing. When rkhunter is first run it has no copy of the
>> >> passwd/group files to check against for changes. Hence the warning. As
>> >> it runs, it will take a copy. When it runs again, it then has a copy,
>> >> so the warning goes away.
>> >
>> >Hmm, actually thinking about it the rkhunter.spec file specifies to
>> >install copies of the files when the rpm is installed. As such the error
>> >should not have occurred. May want to raise that with the packager of
>> >the rpm (i.e. report it via the fedora bugzilla).
>>
>> If they previously exist as name- files due to being edited with vim, they
>> apparently are not over written.  Each was a generation old, not
>> containing my latest additions.  I have over written them now & we'll see.
>>
>> Should the rpm installer have over written them?  I dunno, there could be
>> problems intro'd either way in this case.
>
>The rkhunter installer will not overwrite anything in /etc. The copies
>it takes of the files are for its own use and put into a separate secure
>directory. It is those files it looks for.
>
>Looking at the rkhunter 1.3.2 rpm spec file (as used for the Fedora
>package), it does not seem to take an initial copy of the files. So that
>would explain why you got the initial warning. However, as has already
>been replied, the spec file for 1.3.4 FC10 does do this initial copy
>(although I cannot personally verify that).
>
I tried the rawhide version, but that would have updated about 50% of the 
system to F11.  So I found the 1.3.4 tarball and installed it, and it seems 
all is cool now.

Thanks John.

-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Oh, yeah, life goes on, long after the thrill of livin' is gone.
		-- John Cougar, "Jack and Diane"