Package: chkrootkit
State: installed
Automatically installed: yes
Version: 0.44-2
check root kit find command fails
it is only visible in expert mode:
### Output of: /usr/bin/find //usr/include -name icekey.h -o name iceconf.h -o
name iceseed.h
###
/usr/bin/find: paths must precede expression
Usage: /usr/bin/find [path...] [expression]
It should read
/usr/bin/find //usr/include -name icekey.h -o -name iceconf.h -o -name iceseed.h
# find --version
GNU find version 4.1.20
# dpkg -l chkrootkit
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name Version Description
+++-==============-==============-============================================
ii chkrootkit 0.44-2 Checks for signs of rootkits on the local sy
# chkrootkit -x | grep "^/usr/bin/find"
/usr/bin/find: /var/run/.tmp: No such file or directory
/usr/bin/find: /usr/man/man1/lib/.lib: No such file or directory
/usr/bin/find: /usr/man/man2/.man8: No such file or directory
/usr/bin/find: /usr/man/man1: No such file or directory
/usr/bin/find: /usr/lib/dy0: No such file or directory
/usr/bin/find: /usr/src/.puta: No such file or directory
/usr/bin/find: /etc/rc.d/rsha: No such file or directory
/usr/bin/find: /etc/rc.d/arch/alpha/lib/.lib: No such file or directory
/usr/bin/find: /usr/src/linux/arch/alpha/lib/.lib/: No such file or directory
/usr/bin/find: /usr/include/rpcsvc: No such file or directory
/usr/bin/find: /usr/lib/lib: No such file or directory
/usr/bin/find: /usr/lib/libt: No such file or directory
/usr/bin/find: /usr/src/.poop: No such file or directory
/usr/bin/find: /tmp/ramen.tgz: No such file or directory
/usr/bin/find: /etc/xinetd.d/asp: No such file or directory
/usr/bin/find: /dev/cuc: No such file or directory
/usr/bin/find: /lib/defs: No such file or directory
/usr/bin/find: /usr/lib/security: No such file or directory
/usr/bin/find: /usr/lib/volc: No such file or directory
/usr/bin/find: paths must precede expression
patch:
# diff -Naur chkrootkit.org chkrootkit
--- chkrootkit.org 2004-12-08 20:29:40.000000000 +0100
+++ chkrootkit 2007-01-07 22:34:25.000000000 +0100
@@ -510,7 +510,7 @@
## Madalin rootkit
expertmode_output "${find} ${ROOTDIR}/usr/include -name icekey.h -o \
-name iceconf.h -o name iceseed.h"
+-name iceconf.h -o -name iceseed.h"
### shell history file check
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
