Hi all,
I have written a script in /etc/cron.daily for chkrootkit to screen out known
suspect files that are OK & to email me with anthing else ... (ahem its not a
gentoo system ... just thought I should come clean :))
#!/bin/sh
# Adds a primitive filter of repeating false positives
OUTFILE=`mktemp` || exit 1
chkrootkit -q\
| grep -v 'PACKET SNIFFER(/sbin/dhclient3'\
| grep -v '/usr/lib/jvm/.java-gcj.jinfo'\
| grep -v '/usr/lib/realplay-10.0.6/share/default/.realplayerrc'\
| grep -v '/usr/lib/jvm/java-1.5.0-sun-1.5.0.06/.systemPrefs'\
| grep -v '/usr/lib/jvm/.java-1.5.0-sun.jinfo'\
| grep -v '/usr/lib/mindi/rootfs/root/.profile'\
| grep -v '/usr/lib/mindi/rootfs/proc/.keep'\
> $OUTFILE 2> /dev/null
val1=$(wc -l < $OUTFILE)
if [ $val1 -ge 3 ] ; then
cat $OUTFILE | mail -s "[ckrootkit] Daily run" root
fi
rm -f $OUTFILE
All works as expected except the 2> /dev/null appears not to work. I get the
following emailed to me ...
/etc/cron.daily/chkrootkit-filter:
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-02_07.19.43.912205.vanda-comp.ful:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-02_07.38.48.421654.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-02_07.40.10.454279.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-03_10.19.03.870135.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-04_11.36.46.651743.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-05_07.37.17.335699.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-06_17.37.02.619804.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-07_09.04.20.615943.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-02_07.19.43.912205.vanda-comp.ful:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-02_07.38.48.421654.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-02_07.40.10.454279.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-03_10.19.03.870135.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-04_11.36.46.651743.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-05_07.37.17.335699.vanda-comp.inc:
Permission denied
/usr/bin/find:
//mnt/samba/archive/vanda-comp_backup/2006-07-06_17.37.02.619804.vanda-comp.inc:
Permission denied
Is there a way to avoid script errors being emailed to me ? Apart from maybe
executing this script within a wrapper script ie ...
chkrootkit &> /dev/null
Any suggestions very welcome
Dave
--
gentoo-user@gentoo.org mailing list
