Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #189357

Re: [rkhunter] coyote.coyote.den - Daily report

Show all headers | View raw

On 27-11-17, Gene Heskett wrote:
> On Monday 27 November 2017 17:39:45 Brian wrote:
> 
> > On Mon 27 Nov 2017 at 16:56:15 -0500, Gene Heskett wrote:
> > > On Monday 27 November 2017 15:57:34 Brian wrote:
> > > > On Mon 27 Nov 2017 at 15:46:55 -0500, Gene Heskett wrote:
> > > > > On Monday 27 November 2017 14:35:17 root wrote:
> > > > >
> > > > > Installed new firefox-esr yesterday, from the wheezy repos.
> > > > > Today, rkhunter has a cow:
> > > >
> > > > [rkhunter nonsense snipped]
> > > >
> > > > > How should I restore?
> > > >
> > > > Restore what?
> > >
> > > An obviously contaminated firefox-esr. Or whatever in this list is
> > > contaminated: Its to complete list from the last wheezy update.
> > >
> > > Turns out that rkhunter looked over firefox-esr on its previous run
> > > and apparently gave it a passing grade. So I have to assume its
> > > something in yesterdays list:
> >
> > [Long list snipped]
> >
> > I'd ignore it. Better still, purge rkhunter from the system. It is
> > renowned for giving false positives. There is no well-substantiated
> > account of it ever discovering anything of consequence.
> 
That is terrible advice. If you do not understand it, purge it and
warnings will be gone. That rkhunter is approved, tested and well used
and recommended tool by some security experts is of no value at all.

> Thats another possibility, I get tired of its mewling about stuff thats 
> normal here. I use amanda, so yes, xinetd is in use, and other similar 
> crap. I am amazed it doesn't fuss about ~/gene/bin/mailwatcher, which is 
> my coupling between fetchmail and kmail.
> 
> Cheers, Gene Heskett
> -- 
> "There are four boxes to be used in defense of liberty:
>  soap, ballot, jury, and ammo. Please use in that order."
> -Ed Howdershelt (Author)
> Genes Web page <http://geneslinuxbox.net:6309/gene>
> 

If you are tired of its "mewling about stuff thats normal here" then do
something about it. Rkhunter has conf file where you can whitelist that
stuff.

All that rkhunter did was its job. He issued you warnings about some
stuff that according to its conf file is suspicious. Now, it is on you
to investigate that and see if those warnings  are serious, or not.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-27 21:50 +0100
  Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-27 22:00 +0100
    Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-27 23:00 +0100
      Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-27 23:50 +0100
        Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-28 03:50 +0100
          Re: [rkhunter] coyote.coyote.den - Daily report "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-11-28 10:10 +0100
            Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-28 11:20 +0100
              Re: [rkhunter] coyote.coyote.den - Daily report "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-11-28 12:40 +0100
                Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-28 13:30 +0100
              Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-28 14:10 +0100
          Re: [rkhunter] coyote.coyote.den - Daily report Dejan Jocic <jodejka@gmail.com> - 2017-11-28 13:30 +0100
            Re: [rkhunter] coyote.coyote.den - Daily report Michael Stone <mstone@debian.org> - 2017-11-28 16:40 +0100
              Re: [rkhunter] coyote.coyote.den - Daily report Dejan Jocic <jodejka@gmail.com> - 2017-11-28 17:30 +0100
  Re: [rkhunter] coyote.coyote.den - Daily report deloptes <deloptes@gmail.com> - 2017-11-27 23:40 +0100
    Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-28 03:50 +0100
      Re: [rkhunter] coyote.coyote.den - Daily report deloptes <deloptes@gmail.com> - 2017-11-28 08:10 +0100
        Re: [rkhunter] coyote.coyote.den - Daily report "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-11-28 09:10 +0100

csiph-web