On Wed, 2008-02-27 at 06:13 +1000, Michael Mansour wrote: > Hi, > > In the daily run I keep getting the following: > > Warning: Package manager verification has failed: > File: /usr/bin/chattr > The file hash value has changed > The file size has changed > The file modification time has changed > Warning: Package manager verification has failed: > File: /usr/bin/lsattr > The file hash value has changed > The file size has changed > The file modification time has changed > > I use the option: > > RTKT_FILE_WHITELIST="/usr/bin/chattr /usr/bin/lsattr" > This option applies to 'rootkit' checks.
> while I have my PKGMGR set to RPM. > > Why aren't these two files whitelisted? > Because the warnings are about 'file properties', not rootkits. You can't whitelist files from the package manager. Did you run 'rpm -Vf /usr/bin/chatter'? What did it show? John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839 ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Rkhunter-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/rkhunter-users
