similar to: really clean install? - attachments

Good evening, I was finish the FreeBSD4.9 installation from CD, and only do some edit with the /etc/rc.firewall, /etc/rc.conf, /boot/defaults/loader.conf, and recompiling the kernel to support my ext2 backup harddisk, with sndcard support too. This's a old laptop (ibm380z), i have chkrootkit warning after all finished, i attached my uname -a, dmesg, pkg_info and chkrootkit result, please

Hello guys, any news about successfuly booting OpenBSD with Syslinux? I have exactly the same problems of Mr. Benjamin Pineau, as reported by him in this email : http://www.zytor.com/pipermail/syslinux/2004-April/003374.html I'm trying it with syslinux version 2.09, and OpenBSD 3.5 images. Oh man, it would be really great to have Syslinux outstanding functionalities in my custom OpenBSD

Hello, According to * ports/54407 Newer bsd.port.mk don't work on FBSD 4.6.2 or prior * ports/54475 due to changes in bsd.port.mk, ports no longer install on pre-4.7 releases. * ports/54561 all ports currently fail on FreeBSD 4.5 it seems quite a few people have problems installing FreeBSD ports, because port installation has started using pkg_info's -O parameter. I have also been

Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or later report chfn, chsh, and date as infected? I built world yesterday, and my nightly chkrootkit reports this on run. I've replaced the binaries with their 4.9 equivalents, and things don't report as infected. I upgrade the 4.9 machine to 4.10, and chkrootkit reports them as infected again. Is this similar to the

Below is a cut and past from my log files that are sent to me. This is from the last day that proftpd worked correctly. I'm not sure why proftpd was restarted as the log states: ################### LogWatch 5.2.2 (06/23/04) #################### Processing Initiated: Sun Feb 19 09:02:02 2006 Date Range Processed: yesterday Detail Level of Output: 0 Logfiles

Hey all, I've submitted a fix for chkrootkit port, to solve the false positives on FreeBSD 5 and higher: http://www.freebsd.org/cgi/query-pr.cgi?pr=55919 The topic, btw, should be "Teach security/chkrootkit about FreeBSD 5", but it's not my first typo today. Maintainer, please approve. Authors, please see if you can include the changes. I also fixed a minor bug in chk_vdir.

I ran chkrootkit ( v. chkrootkit-0.43 ) earlier and noticed that chfn, date, and chsh showed as being infected. I remember reading post from the past that right now chkrootkit is giving alot of false positives, so I suspected that these 3 binaries are not bad. However, to be on the safe side, I deleted the 3 binaries, removed /usr/src and did a 'make world' to 4.10-STABLE. But, chfn,

Hello, Please, don't use chkrootkit 0.46 on production machines. The "chkproc" process sends a SIGXFSZ (25) signal to init, that interprets this signal as a "disaster" and reboots after a 30s sleep. I'm contacting the chkrootkit maintainer to fix this problem. Sorry, Cordeiro

My machine got hacked a few days ago through the samba bug. I reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM but still... Can anyone please advise ? bash-2.05b# chkrootkit | grep INFECTED Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `date'... INFECTED Checking `ls'... INFECTED Checking `ps'... INFECTED -- Jay -------------- next

Hi, I have a problem with managing samba package on FreeBSD. On the first run puppet will install the package fine. However, it will try to install it again on consecutive runs, even though the package is already present on the system. The package name is samba3 and that''s how it''s defined in the manifest, but when I run pkg_info it shows up as samba-3.0.23c_2,1. Is it

Hi, I installed a lot of packages by using: pkg_add -r pkgname But now when I do a pkg_info I get : lifebook:/home/gmarco# pkg_info -Ia Mesa-3.4.2_2 A\ graphics\ library\ similar\ to\ SGI\'s\ OpenGLXFree86-4.3 .0,1 X11/XFree86\ core\ distribution\ \(complete,\ using\ mini/m XFree86-FontServer-4.3.0 XFree86-4\ font\ serverXFree86-Server-4.3.0_6 XFree86-4 \ X\ server\ and\

Well, colleagues, I'm stuck a bit. I tried many different ways to setup system with vinum root (the only reference I found yet besides old "bootstrapping vinum" article is Joerg's commit message: http://freebsd.rambler.ru/bsdmail/cvs-all_2003/msg01225.html I failed. I have 4-stable system set up at ad0, and tried to set up pair of drives for new system at ad2 and ad3 (actually,

I run chkrootkit daily. For the first time I've got reports of a problem - Checking `bindshell'... INFECTED (PORTS: 1008) The page http://fatpenguinblog.com/scott-rippee/checking-bindshell-infected- ports-1008/ suggests that this might be a false positive, so I ran 'netstat - tanup' but unlike the report, it wasn't famd on the port. It was tcp 0 0 0.0.0.0:1008

Hello; I'm running a FreeBSD 4.10-release-p2 box and both chkrootkit 0.44 & 0.45 report that my /sbin/init file is infected. It appears as though the egrep for "UPX" in the output of "strings" triggers the infected notice. When I copy the init file from an uninfected box to this one chkrootkit continues to report it as infected. Is chkrootkit reading a copy of the

Hello, last night, my chkrootkit crontab returned an alarm message : > Checking `lkm'... You have 1 process hidden for readdir command > You have 2 process hidden for ps command > Warning: Possible LKM Trojan installed Some research on google make me think it's probably a false positive. I tried few things : re-launching chkrootkit : "Checking `lkm'...

Hi! Running chkrootkit on newly installed FreeBSD 5.0 got: -cut- Checking `basename'... not infected Checking `biff'... not infected Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `cron'... not infected Checking `date'... INFECTED -cut- Checking `ls'... INFECTED -cut- Checking `ps'... INFECTED Checking `pstree'... not found -cut- What does it

Hi, The problem started when i installed a kodicom 4400 card and started to run zoneminder. Prior to that no problems with my machine, which now runs FreeBSD panix.internal.net 7.0-RELEASE-p3 FreeBSD 7.0-RELEASE-p3 #3: Mon Jul 14 16:35:37 EEST 2008 doroot@panix.internal.net:/usr/obj/usr/src/sys/GENERIC i386 This hardware change happened in Sunday Jul 13. The next day (Jul 14) morning

How can I be sure if it is LKM or not? Today I've run chkrootkit and it gave me: Checking `lkm'... You have 179 process hidden for readdir command You have 179 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed Checking `chkutmp'... The tty of the following user process(es) were not found in /var/run/utmp ! ! RUID PID TTY CMD ! root

Good morning all; Whils't running chkrootkit 0.42 on one of my 4.7-REL boxen it reported : <snip> Checking 'biff'...not infected ]: not found [: -ne: argument expected Checking 'chfn'...not infected ]: not found [: -ne: argument expected <snip> I've been unable to locate any information ref. the " ]: not found " and " [: -ne: argument

The CentOS Development team is pleased to announce the availability of the first CentOS 4 i386 Live CD. This CD is based on our CentOSPlus Kernel and the CentOS-4.3 i386 distribution. It can be used a Workstation, with the following software: Open Office 1.1.2 Evolution 2.0.2 Firefox 1.5.0.2 Gimp 2.0.5 k3b 0.11.14 (for burning CDs and DVDs) Gaim 2.0.0 xchat 2.4.0 Built in support for the