Re: [Rkhunter-users] whitelisted file but still warning

2007-11-05 Thread John Horne
On Mon, 2007-11-05 at 17:12 +, Dogsbody wrote: > >> ... as you can see, I have added /sbin/ifup to SCRIPTWHITELIST however > >> it still seems to show as a warning!? > >> Is it because I am using PKGMGR=RPM? > > > > Yes. If you run 'rpm -Vf /sbin/ifup' it will show that the RPM package > > man

Re: [Rkhunter-users] whitelisted file but still warning

2007-11-05 Thread Dogsbody
>> ... as you can see, I have added /sbin/ifup to SCRIPTWHITELIST however >> it still seems to show as a warning!? >> Is it because I am using PKGMGR=RPM? > > Yes. If you run 'rpm -Vf /sbin/ifup' it will show that the RPM package > manager thinks the file has changed (probably showing 5, S and T

Re: [Rkhunter-users] whitelisted file but still warning

2007-11-05 Thread John Horne
On Mon, 2007-11-05 at 16:12 +, Dogsbody wrote: > Hi, > > Just upgrading to 1.3.0 and it's looking great so far. A few warnings > to start with but after checking things out and adding things to the > config file I am just left with one... > > [15:53:58] /sbin/ifup

[Rkhunter-users] whitelisted file but still warning

2007-11-05 Thread Dogsbody
Hi, Just upgrading to 1.3.0 and it's looking great so far. A few warnings to start with but after checking things out and adding things to the config file I am just left with one... [15:53:58] /sbin/ifup[ Warning ] [15:53:58] Warning: Package manager ver

Re: [Rkhunter-users] rkhunter warnings on freebsd 6.2 release

2007-11-05 Thread John Horne
On Mon, 2007-11-05 at 10:10 +0100, Peo Nilsson wrote: > Dear listmembers. > > When I run rkhunter 1.3.0 i get those warnings: > > /usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne > shell script text executable > > /usr/sbin/adduser' has been replaced by a script: /usr/sbin

[Rkhunter-users] rkhunter warnings on freebsd 6.2 release

2007-11-05 Thread Peo Nilsson
Dear listmembers. When I run rkhunter 1.3.0 i get those warnings: /usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable /usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: Bourne shell script text executable /usr/local/bin/GET' has