RE: [cobalt-users] chkrootkit v0.34

[flash22@xxxxxxx]

On Thu, 18 Oct 2001, Curtis Ross wrote:

> 
> > has anyone installed the latest version of chkrootkit? i am getting
> the following error when it runs:
> > 
> > integer expression expected before -gt
   Have only seen that error in package installer...what gives that?

> > 
> > also, i have never been able to get ifpromisc to compile correctly. i
> am on a raq2.

You need to patch up the broken network headers on the raq2 ;)

You can patch the chkroot's source without munging with the raq however..

In ifpromisc.c make the following 2 changes then recompile (make sense)

Find #include <socket.h> , put // before it (eg comment it out, it's not
needed)

Before the FIRST #include line, add a line thus:

#define __SSIZE_TYPE__ int

That fixes a missing intrinsic type in the gcc that's on the raq2
(ps: this is not a properfix, so don't go adding it elsewhere, crk 
doesn't use this type, it's just to make the compiler happy)

On a clean machine it should find only some stray .packlist files (bogus) 
With portsentry it will find bogus BINDSHELL hits on 2 or 3 ports

Be aware that many of the things it is checking for you probably won't
find on non-intel machines anyhow ;)

gsh