Re: rkhunter message

2009-10-05 Thread Jérémie Marguerie
On Mon, Oct 5, 2009 at 11:09 PM, Paul Cartwright wrote: > :/dev/shm# ls -l > total 8 > -rw-r- 1 pbc pbc    4096 2009-10-04 13:11 mono.17997 > -rw-r- 1 pbc pbc   79880 2009-10-04 13:11 > mono-shared-1000-shared_data-paulandcilla.homelinux.org-Linux-i686-312-12-0 > -rw-r- 1 pbc pbc 36864

rkhunter message

2009-10-05 Thread Paul Cartwright
I got this from the rkhunter cron job today ( never seen it before, or the files listed): Warning: Suspicious file types found in /dev:           /dev/shm/mono-shared-1000-shared_fileshare-paulandcilla.homelinux.org-Linux-i686-36-12-0: data           /dev/shm/mono-shared-1000-shared_data-pauland

Re: rootkit not found by rkhunter

2009-10-05 Thread dann frazier
On Sun, Oct 04, 2009 at 12:16:14PM -0400, Michael S Gilbert wrote: > On Sun, 4 Oct 2009 11:44:52 -0400 Thomas Krichel wrote: > > It looks like the affected machines run older kernels, so > > I will follow your advice and upgrade. > > i forgot to mention that 'uname -r' won't actually tell yo

Re: rootkit not found by rkhunter

2009-10-05 Thread Florian Weimer
* Noah Meyerhans: > AFAIK, the best way to know if you're running a stale kernel is to > compare the uptime of the machine against the mtime of the actual kernel > (using, e.g. "stat /boot/vmlinuz-2.6.26-2-686"). If the uptime of the > machine places the last reboot sometime before the kernel was