similar to: chkrotkit 4.1 and FreeBSD 4.5

Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or later report chfn, chsh, and date as infected? I built world yesterday, and my nightly chkrootkit reports this on run. I've replaced the binaries with their 4.9 equivalents, and things don't report as infected. I upgrade the 4.9 machine to 4.10, and chkrootkit reports them as infected again. Is this similar to the

Hi, I have a 4.9-STABLE FreeBSD box apparently hacked! Yesterday I ran chkrootkit-0.41 and I don't like some of the outputs. Those are: chfn ... INFECTED chsh ... INFECTED date ... INFECTED ls ... INFECTED ps ... INFECTED But all the rest is NOT PROMISC, NOT INFECTED, NOTHING FOUND, NOTHING DELETED, or NOTHING DETECTED. I know by the FreeBSD-Security archives that

I ran chkrootkit ( v. chkrootkit-0.43 ) earlier and noticed that chfn, date, and chsh showed as being infected. I remember reading post from the past that right now chkrootkit is giving alot of false positives, so I suspected that these 3 binaries are not bad. However, to be on the safe side, I deleted the 3 binaries, removed /usr/src and did a 'make world' to 4.10-STABLE. But, chfn,

My machine got hacked a few days ago through the samba bug. I reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM but still... Can anyone please advise ? bash-2.05b# chkrootkit | grep INFECTED Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `date'... INFECTED Checking `ls'... INFECTED Checking `ps'... INFECTED -- Jay -------------- next

Hi! Running chkrootkit on newly installed FreeBSD 5.0 got: -cut- Checking `basename'... not infected Checking `biff'... not infected Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `cron'... not infected Checking `date'... INFECTED -cut- Checking `ls'... INFECTED -cut- Checking `ps'... INFECTED Checking `pstree'... not found -cut- What does it

Hey, Gang! To ensure that a file hasn't been corrupted or tampered with, you can use rpm to verify the package it came from. Well, I found this: rpm -Vv util-linux .... ........ /usr/bin/cal S.?..... /usr/bin/chfn ........ /usr/bin/chrt S.?..... /usr/bin/chsh .... Does anyone else get this? And what would be the proper course of action at this point? Thanks mucho. --

Good morning all; Whils't running chkrootkit 0.42 on one of my 4.7-REL boxen it reported : <snip> Checking 'biff'...not infected ]: not found [: -ne: argument expected Checking 'chfn'...not infected ]: not found [: -ne: argument expected <snip> I've been unable to locate any information ref. the " ]: not found " and " [: -ne: argument

prepping to teach a 5-day CompTIA linux+ course next week with CompTIA-supplied courseware and, given that it was my choice, i chose to set up the classroom with centos 7.4 on all the student systems since i assume most students are there to learn sysadmin and that's the most likely platform they'll have when they get back to work. also, most students are taking this course to prep for the

On 09/02/15 06:29, Jason Long wrote: > Thanks. > I added the Two lines to "smb.conf" but I got below error : > > Could not chdir to home directory /home/jason: No such file or directory > mkdir: cannot create directory ?/home/jason?: Permission denied > -sh-4.2$ > > > About "PAM", I have not the file that you said : > > > [root at printmah

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:58 Security Advisory FreeBSD, Inc. Topic: chpass family contains local root vulnerability Category: core Module:

I have an rsync daemon running on a FreeBSD 7.3 system. It is running rsync 3.0.4 with fileflags enabled. I have the following six files on it which are all hardlinks and have the immutable flag set: 6830483 -r-sr-xr-x 6 root wheel schg 33268 Jan 6 2005 chfn 6830483 -r-sr-xr-x 6 root wheel schg 33268 Jan 6 2005 chpass 6830483 -r-sr-xr-x 6 root wheel schg 33268 Jan 6 2005

Hello, I'm running FreeBSD 9.0/amd64, pure ZFS setup, one Seagate disk ST2000NM0011 SN02 on LSI Logic (mpt) controller. Yes, I know that running one disk on RAID controller is a bit weird, I have to find yet if it is possible to connect disk to internal SATA controller. About two days ago, system became SLOW. Disk usage is constantly 100%, and sometimes I'm getting swap_pager:

On 08/02/15 06:51, Jason Long wrote: > Thanks a lot. > > [root at printmah ~]# getent passwd jason > jason:*:11303:10513:jason JASON:/home/JASONDOMAIN/jason:/bin/false > > But I can't login to Linux via AD username and it show me : > > > > Last login: Sun Feb 8 01:48:32 2015 > Could not chdir to home directory /home/JASONDOMAIN/jason: No such file or directory

In the winbind docs it says the following: "In /etc/pam.d/* replace the auth lines with something like this:" By this (/etc/pam.d/*) do they mean that we change ALL the files in that directory? If not, what files do we change? Another set of docs i read for winbind stated that i should change the /etc/pam.d/samba file, but on my TurboLinux 6.5 and RH 7.1 systems that file doesn't

Thanks. I added the Two lines to "smb.conf" but I got below error : Could not chdir to home directory /home/jason: No such file or directory mkdir: cannot create directory ?/home/jason?: Permission denied -sh-4.2$ About "PAM", I have not the file that you said : [root at printmah ~]# nano /etc/pam.d/ atd password-auth smtp chfn

I am (attempting to) implement an rsync method for distributing updates from a FreeBSD master server to several 'slave' servers. In addition to keeping certain userland files up to date it I also want it to keep the OS up to date. I've run into a problem that I do not know how to fix. When I run the following command: rsync -aHXA --fileflags --force-change --no-inc-recursive

https://bugzilla.samba.org/show_bug.cgi?id=10325 Summary: Links to files marked schg (system immutable) fail Product: rsync Version: 3.1.0 Platform: x64 OS/Version: FreeBSD Status: NEW Severity: normal Priority: P3 Component: core AssignedTo: wayned at samba.org ReportedBy: rkoberman at

Thanks a lot. Thanks a lot. Problem solved and I can login in to Linux without any problem but I guess it is just for CentOS 7 and if you remember CentOS 6.5 not have this problem. Step 1 finished. Step 2 How can I create a Directory and apply permission via AD? Cheers. On Monday, February 9, 2015 12:34 AM, Rowland Penny <rowlandpenny at googlemail.com> wrote: On 09/02/15 06:29, Jason

Hey all, I've submitted a fix for chkrootkit port, to solve the false positives on FreeBSD 5 and higher: http://www.freebsd.org/cgi/query-pr.cgi?pr=55919 The topic, btw, should be "Teach security/chkrootkit about FreeBSD 5", but it's not my first typo today. Maintainer, please approve. Authors, please see if you can include the changes. I also fixed a minor bug in chk_vdir.

Good evening, I was finish the FreeBSD4.9 installation from CD, and only do some edit with the /etc/rc.firewall, /etc/rc.conf, /boot/defaults/loader.conf, and recompiling the kernel to support my ext2 backup harddisk, with sndcard support too. This's a old laptop (ibm380z), i have chkrootkit warning after all finished, i attached my uname -a, dmesg, pkg_info and chkrootkit result, please