• [^] # Re: lsof / fichier de conf

    Posté par . En réponse au message rkhunter Invalid BINDIR configuration option. Évalué à -1.

    RedHat ne supporte pas rkhunter et rookit
    J'ai passé chkrootkit il n'a rien trouvé. Depuis tous les je reçois 2 mails de type
    le premier :
    [rkhunter] Warnings found for host Please inspect this machine, because it may be infected.
    Le dexieme :
    [ Rootkit Hunter version 1.3.8 ]

    Checking rkhunter data files...
    Checking file mirrors.dat [ No update ]
    Checking file programs_bad.dat [ No update ]
    Checking file backdoorports.dat [ No update ]
    Checking file suspscan.dat [ No update ]
    Checking file i18n/cn [ No update ]
    Checking file i18n/de [ No update ]
    Checking file i18n/en [ No update ]
    Checking file i18n/zh [ No update ]
    Checking file i18n/zh.utf8 [ No update ]

    Start Rootkit Hunter Scan ----------------------
    Warning: Checking for prerequisites [ Warning ]
    The file of stored file properties (rkhunter.dat) does not exist, and should be created. To do this type in 'rkhunter --propupd'.
    Warning: WARNING! It is the users responsibility to ensure that when the '--propupd' option
    is used, all the files on their system are known to be genuine, and installed from a
    reliable source. The rkhunter '--check' option will compare the current file properties
    against previously stored values, and report if any values differ. However, rkhunter
    cannot determine what has caused the change, that is for the user to do.
    Warning: Found enabled xinetd service: /etc/xinetd.d/rexec
    Warning: Found enabled xinetd service: /etc/xinetd.d/rlogin
    Warning: Found enabled xinetd service: /etc/xinetd.d/rsh>
    Warning: The SSH and rkhunter configuration options should be the same:
    SSH configuration option 'PermitRootLogin': yes
    Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': unset
    Warning: Hidden directory found: /etc/.java
    Warning: Hidden file found: /etc/.shadow.swp: data

    J'ai vérifié le crontab je n'ai pas trouvé ce qui lancé ce script
    Je suis aller sur le site http://www.rootkit.nl/ mais je n'ai rien trouvé...
    Merci de votre aide....