Re: [cobalt-users] [RaQ3] Infected files after patching

["bill" <bmoore@xxxxxxxxxxxxxxxxx>]

where did you get the chkrootkit ?

Bill
----- Original Message -----
From: "Carrie Bartkowiak" <ravencarrie@xxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Thursday, September 06, 2001 4:09 AM
Subject: RE: [cobalt-users] [RaQ3] Infected files after patching


> On Thu, 6 Sep 2001 00:46:33 -0400, Jason D. Piercy mumbled something like:
> >>I have my chkrootkit in /home/chkrootkit
> >>what does my crontab entry need to look like
>
> Well, let's say you want it to run every night at 1 am and mail the
results to you.
> I'm gonna assume that the actual path to the program itself is
/home/chkrootkit/chkrootkit. If not, change the below to whatever it really
is.
> Your crontab would look like such:
> * 1 * * * root /home/chkrootkit/chkrootkit | mail -s "Chkrootkit Report"
admin
>
> That would run it as root and mail it to your admin account. To change the
email addy just put the name of another user on the machine or a full email
address.
>
> If anyone sees anything wrong with my syntax please correct me!
> --
> CarrieB
> "The point to remember is that what the government gives, it must first
take away." --John S. Coleman
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users