[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] CHkrootkit output

Subject: Re: [cobalt-users] CHkrootkit output


> Checking `sniffer'... /proc/5/fd: Permission denied
>
> > I installed lsof.
> > and nothing strange turned up also google somewhat around and did the >
>
> > To be totaly sure i installed chkrootkit 0.43 on a fresh installed raq,
> > matched the file size of several critical binairys and also run
> chkrootkit.
> > And to my surprise the same error appeared. I will investigate this >
> Robbert
>
> hummmm...  I have been using chkrootkit 0.42b in my security package for
> long time now and it dosen't make that error...  however when I get the
> latest (0.43 version) from http://www.chkrootkit.org/ I get the same error
> as you...  "Checking `sniffer'... /proc/5/fd: Permission denied" which
> automaticly makes me think it's a chkrootkit problem and not a problem
with
> /proc/5/fd ...
>
> Also I found this in the archive... Might just be the answer...
> http://list.cobalt.com/pipermail/cobalt-users/2004-April/102450.html
>
> :)  Have a nice trip! :)
>

I did not know they had a chkrootkit .43! Been using .42b. Wonder if .43
outputs any of the 2 following lines on
raq3-4's?

with nuonce mysql installed

/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/DBI/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Msql-Mysql-modules/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Jcode/.packlist
/usr/lib/perl5/5.00503/i386-linux/.packlist

none or solarspeed mysql installed

/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Jcode/.packlist
/usr/lib/perl5/5.00503/i386-linux/.packlist

Might it maybe make it into a Zeffie raq3-4 package file?

  David Hahn
  PageKeeper Service
  1512 Deborah Road #102
  Rio Rancho, New Mexico 87124 US
  505-892-8723
  http://www.pagekeeperservice.com