RE: [cobalt-users] [RaQ 4] chkrootkit PKG now available

["David Thornton" <dave@xxxxxxxxxxxxxx>]

Ok. I just ran this and one of my RAQ's shows a possible slapper worm
installed....
I just don't see anything that tells me how to get rid of it.
Anyone have any good directions?

David Thornton
Pri-Fly, Inc
2536 Youngs Drive
Haymarket VA 20169
703-753-3206
Fax 703-832-4852
www.prifly.com
dave@xxxxxxxxxx

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx] On Behalf Of Bruce Timberlake
Sent: Tuesday, February 18, 2003 8:03 PM
To: cobaltfacts@xxxxxxxxxxxxxxxxxxxx
Cc: cobalt-users@xxxxxxxxxxxxxxx
Subject: [cobalt-users] [RaQ 4] chkrootkit PKG now available

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I rolled up a PKG for RaQ 4 of chkrootkit v0.39a.  It's available in 
the Download section at http://www.cobaltfaqs.com/

It runs by default at 00:03 and 12:03 daily.  If you want to change 
it, shell in as root and do "crontab -e"...

The "chkrootkit" binary is located in /usr/local/sbin if you ever want 
to run it manually.

PKGs for other products will be forthcoming.

BTW, I'm also toying with an "interactive" GUI for it (i.e., go to an 
admin page and click a button to run chkrootkit manually). Results 
will get returned to the browser, to avoid having to open a shell 
session.  Anyone interested?  Reply offline with comments, etc.

- -- 
Bruce Timberlake

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+UtevvLA2hUZ9kgwRAlYyAJ9D0jVgLxAj12m5GviYvhMiV3NP+QCcCkwu
g/QuXggunvKjb57Usx97oFc=
=4Nce
-----END PGP SIGNATURE-----


_____________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users