Hi
1) My objective is to use a live cd that I can take to anyone's computer and
have it scan a hard
drive and not write to disk. So far, I have failed. Any assistance in the
objective will be
greatly appreciated.
Looking at rkhunter --help I was unable to see a option --notmp or words to
that effect.
2) I can install RKH into the live cd structure easy peasy. Altho with RIP I
had to mkdir
/usr/local
3) Without installing rkh, and using a live cd, I can chroot into a read write
mounted partition
eg mkdir /z ... mount -t xfs /dev/sda1 /z ....chroot /z...mount -t proc none
/proc.....rkhunter -c
-sk ....works but writes the logfile to disk.
rkhunter - c -sk --nolog | less...... produces ugly text but I have confirmed
no log is written.
And the tmp file described below does not appear to have new timestamps.
4) What I want to do, but have failed so far, is to load a independent RKH into
live cd, (done)
but have it scan a mounted folder instead of chroot. AFAIK chroot still wants
to use
/var/lib/rkhunter/tmp so has to be mounted rw.
If I try...mount -t xfs /dev/sda1 -r /z....chroot /z ...mount -t proc none
/proc...rkhunter
(anything), RKH complains that the tmp file is unwriteable.
4) log excerpts that I think relevant follow:
[23:49:58] Running Rootkit Hunter version 1.3.0 on RIPLinuX....(hard drive is
Mdv 2008)
[23:49:58] Info: Using configuration file '/etc/rkhunter.conf'
[23:49:58] Info: Using '/var/lib/rkhunter/tmp' as the temporary directory
[23:49:58] Info: System is not using prelinking
and proof its my hard drive being checked and not the cd:
[23:49:59] Old host value: gs New value: RIPLinuX
cheerio
Make the switch to the world's best email. Get the new Yahoo!7 Mail now.
www.yahoo7.com.au/worldsbestemail
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Rkhunter-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
