Use a bootable disc with either or both tools on it, boot the machine(s) in
question with that media and then run the tests. Fedora 17, which just came
out, has a bootable security spin you could/should try, too.
>________________________________
> From: Beartooth <bearto...@comcast.net>
>To: users@lists.fedoraproject.org
>Sent: Thursday, June 7, 2012 11:16 AM
>Subject: Which to trust: chkrootkit or rkhunter?
>
>
> One tells me, on several machines, that /sbin/init is infected
>with the Suckit rootkit; the other says not. Is there a way to tell
>whether I'm seeing a false positive or a false negative?
>
> Fwiw, this result occurs both on an F16 machine, and on an f17
>one with a fresh install. (Both are fully updated.)
>
>--
>Beartooth Staffwright, Neo-Redneck Not Quite Clueless Power User
>I have precious (very precious!) little idea where up is.
>
>
>--
>users mailing list
>users@lists.fedoraproject.org
>To unsubscribe or change subscription options:
>https://admin.fedoraproject.org/mailman/listinfo/users
>Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>Have a question? Ask away: http://ask.fedoraproject.org
>
>
>
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
