We're running Sarge with kernel 2.6.11, and have tried both
chkrootkit 0.45-1
chkrootkit 0.46a-2
...both of them have the same problem:
# /usr/sbin/chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v -v -p 3
###
CWD 10770: /var/lib/mysql
EXE 10770: /usr/sbin/mysqld
CWD 10771: /var/
most recently...
# /usr/sbin/chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v -v -p 3
###
CWD 8924: /var/lib/mysql
EXE 8924: /usr/sbin/mysqld
CWD 8925: /var/lib/mysql
EXE 8925: /usr/sbin/mysqld
CWD 9223: /var/lib/mysql
EXE 9223: /usr/sbin/mysqld
CWD 9249: /var/lib/mysql
EXE
yah...it does...
/usr/sbin# chkrootkit lkm
ROOTDIR is `/'
Checking `lkm'... SIGINVISIBLE Adore found
chkproc: Warning: Possible LKM Trojan installed
peace,
Nolan
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
ah...right. I see what you mean.
FWIW, my system and architecture listed above (previous email) were:
> We're running Sarge with kernel 2.6.11, and have tried both
>
> chkrootkit 0.45-1
> chkrootkit 0.46a-2
...and at that time, I was getting:
/etc/cron.daily/chkrootkit:
You have 1 process
just the one...it's a mail server, running vexim2 (hence MySQL),
mailman, clamav, etc...
machine 2:
using chkrootkit 0.44-2
a webserver, gets similar results for chkproc (MySQL), but no SIGINVISIBLE
machine 3:
using chkrootkit 0.44-2
DNS server, chkproc returns nothing, no SIGINVISIBLE
I gave
downgraded to chkrootkit 0.44-2 (stable):
# /usr/sbin/chkrootkit lkm
ROOTDIR is `\'
Checking `lkm'... nothing detected
hm.
peace,
Nolan
lantz moore wrote:
Nolan Andres <[EMAIL PROTECTED]> writes:
The more recent results were shown given:
kernel: 2.6.15
chkrootkit: 0.46a-
Package: mantis
Version: 0.19.2-4
* mantis requires mysql-client
* mysql-client conflicts with mysql-client-5.0
* mysql-server-5.0 depends on mysql-client-5.0
therefore, mantis conflicts with mysql-server-5.0
since the Mantis software apparently runs with MySQL 5.0, this should
likely be correc
7 matches
Mail list logo
