I just installed rkhunter on this F7 machine and am using the default config file (probably a mistake.) This morning I found this in my mail: Subject: [rkhunter] Warnings found for medulla Date: Mon, 18 Aug 2008 04:07:41 -0700 (PDT) Please inspect this machine, because it may be infected. I've looked at the generated log and found nothing suspicious. But I'm not an experienced hunter and the log is >1000 lines long. I'd like to post it here but I think it is too long for that. Here is the final summary: [04:07:40] System checks summary [04:07:40] ===================== [04:07:40] [04:07:40] File properties checks... [04:07:40] Required commands check failed [04:07:40] Files checked: 129 [04:07:41] Suspect files: 0 [04:07:41] [04:07:41] Rootkit checks... [04:07:41] Rootkits checked : 64 [04:07:41] Possible rootkits: 0 [04:07:41] [04:07:41] Applications checks... [04:07:41] Applications checked: 5 [04:07:41] Suspect applications: 0 [04:07:41] [04:07:41] The system checks took: 29 seconds [04:07:41] [04:07:41] Info: End date is Mon Aug 18 04:07:41 PDT 2008 The only thing that catches the eye is the "Required commands check failed." But a search for the words "failed" or "required" finds only this line. Lots of stuff was "skipped" in the log. For example: [04:07:35] Performing trojan specific checks [04:07:35] Info: Starting test name 'trojans' [04:07:36] Checking for enabled inetd services [ Skipped ] [04:07:36] Info: Check skipped - file '/etc/inetd.conf' does not exist. Indeed it doesn't. I believe it has been replaced by /etc/xinetd.d/ This machine has iptables running on it is behind our corporate firewall. I'm not sure how to proceed. Dean -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
