chkrootkit warning

qwertyjjj · 01-10-2010, 11:08 AM

Quote:

Originally Posted by alunduil

What time does chkrootkit run and what time does cron run? Does cron run the chkrootkit? If so, I'm willing to bet that chkrootkit is finding it's own parent and saying it's a break-in.

Regards,

Alunduil

There are a few things run by cron at about 0000 and 0100 and chkrootkit is one of those. Actually, cron runs a .sh file, which also contains functions to run the chkrootkit and rkhunter amongst other things.

alunduil · 01-10-2010, 12:15 PM

And that process that chkrootkit complains about is only present when the cron job for chkrootkit is running? If so I think you can at least close that portion of the report as a false-positive.

Regards,

Alunduil