LinuxQuestions.org

FUSE LoggedFS .spec

Posted 06-13-2010 at 06:50 AM by unSpawn

LoggedFS is a fuse-based filesystem which can log every operations that happens in it. See example output in the auditd missing syscalls? thread.

Code:

%define debug_packages	%{nil}
%define debug_package %{nil}
%define name loggedfs
%define ver 0.5
%define rel 1
%define _prefix /usr/local
%define _sysconfdir /usr/local/etc
%define _docdir /usr/local/share/doc
%define _mandir /usr/local/share/man
%define _bindir /usr/local/bin

...

unSpawn

Moderator

Posted in Uncategorized

Views 2878 Comments 0 unSpawn is offline

Unhide .spec (20100201 release)

Posted 02-27-2010 at 05:50 PM by unSpawn

Tags rpm, spec file

security-projects.com released version 2010/02/01 of Unhide, a forensic tool to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique. Here's a minimal spec if you want one:

Code:

# No debuginfo:
%define debug_packages	%{nil}
%define debug_package %{nil}

%define name unhide
# Version
%define ver 0.2
# Release
%define rel 1

%define _prefix /usr/local
%define _mandir /usr/local/share/man

...

unSpawn

Moderator

Posted in Uncategorized

Views 1891 Comments 0 unSpawn is offline

Chkrootkit 0.49 modifications and notes

Posted 01-06-2010 at 05:03 PM by unSpawn

Tags chkrootkit

Chkrootkit 0.49 was released on 2009/07/30 and I sent some emails to the users mailing list and Nelson after it about changes. Realizing I never got word back I'll just post here. The patch below adds:
0) a new test called which utilizes '(/sbin/)ip' instead of 'ifconfig' because a sniffer (benign or malicious) does not need to have the interface in promiscuous mode (e.g.: 'ifconfig eth0 promisc && tcpdump -p -i any 2>&1>/dev/null &') and 'ip' detects and differentiates...

unSpawn

Moderator

Posted in Uncategorized

Views 4142 Comments 0 unSpawn is offline

Rootkit Hunter 1.3.6 release

Posted 11-29-2009 at 10:53 AM by unSpawn

Tags rootkit hunter

I'm pleased to announce the release of Rootkit Hunter version 1.3.6 (D/L link).

This release offers more ease of use (mainly through configuration options) and improved rootkit and malware checks. The change log lists 29 additions including 9 configuration options and details for 12 rootkits, 29 changes including improvements for 15 rootkit checks and 22 bugfixes. For more details please see the CHANGELOG. This release obsoletes all previous ones so please upgrade.

...

unSpawn

Moderator

Posted in Uncategorized

Views 2197 Comments 0 unSpawn is offline