Package: chkrootkit
Version: 0.49-4
Severity: normal
Tags: patch
Is publicly known that chkrootkit generate a lot of false positives, and
that is a pain to receive every day an e-mail with them, making people
to simply ignore those mails most of the time.
Here is a nice post describing an easy way to add an ignore list by
grepping the output:
http://www.electricmonk.nl/log/2007/11/29/chkrootkit-false-positives-filtering/
Attached is an updated patch for /etc/cron.daily/chkrootkit.
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'stable'), (50, 'unstable'), (20,
'experimental')
Architecture: i386 (i686)
Kernel: Linux 3.0.0-1-686-pae (SMP w/1 CPU core)
Locale: LANG=es_AR.UTF-8, LC_CTYPE=es_AR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages chkrootkit depends on:
ii binutils 2.21.90.20111004-2
ii debconf [debconf-2.0] 1.5.40
ii libc6 2.13-21
ii net-tools 1.60-24.1
ii procps 1:3.2.8-11
chkrootkit recommends no packages.
chkrootkit suggests no packages.
-- debconf information:
* chkrootkit/run_daily_opts: -q -n
* chkrootkit/run_daily: true
* chkrootkit/diff_mode: false
diff --git a/cron.daily/chkrootkit b/cron.daily/chkrootkit
index 7a6b7b9..152d503 100755
--- a/cron.daily/chkrootkit
+++ b/cron.daily/chkrootkit
@@ -4,6 +4,7 @@ set -e
CHKROOTKIT=/usr/sbin/chkrootkit
CF=/etc/chkrootkit.conf
+IGNOREF=/etc/chkrootkit.ignore
LOG_DIR=/var/log/chkrootkit
if [ ! -x $CHKROOTKIT ]; then
@@ -16,7 +17,7 @@ fi
if [ "$RUN_DAILY" = "true" ]; then
if [ "$DIFF_MODE" = "true" ]; then
- eval $CHKROOTKIT $RUN_DAILY_OPTS > $LOG_DIR/log.today.raw 2>&1
+ eval $CHKROOTKIT $RUN_DAILY_OPTS | egrep -v -f $IGNOREF > $LOG_DIR/log.today.raw 2>&1
# the sed expression replaces the messages about /sbin/dhclient3 /usr/sbin/dhcpd3
# with a message that is the same whatever order eth0 and eth1 were scanned
sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient3|/usr/sbin/dhcpd3)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient3|dhcpd3]{PID}\),' \
@@ -46,6 +47,6 @@ if [ "$RUN_DAILY" = "true" ]; then
echo "# (note that unedited output is in $LOG_DIR/log.today.raw)"
fi
else
- eval $CHKROOTKIT $RUN_DAILY_OPTS
+ eval $CHKROOTKIT $RUN_DAILY_OPTS | egrep -v -f $IGNOREF || true
fi
fi
