Re: [Rkhunter-users] howto use skdet?

[John H. <joh...@pl...>]

On Tue, 2008-11-04 at 15:10 +0100, bacula wrote:
>
> in rkhunter.log
> 
> [09:08:28] /sbin/skdet                                       [ Warning ]
> [09:08:28] Warning: The file '/sbin/skdet' exists on the system, but it 
> is not present in the rkhunter.dat file.
>  
> yes i didnt run --propupd yet.
>
Okay, but RKH has seen the skdet program. What version of rkhunter are
you using ('rkhunter --version' or the log file will tell you)?

> 
> [09:09:02]     Running skdet command                         [ Warning ]
> [09:09:02] Warning: Suckit Rookit additional checks          [ Warning ]
> [09:09:02]          Running skdet command: unknown version: 
> /usr/bin/rkhunter: 12255: /sbin/skdet: not found
> 
Odd, RKH now says it cannot see the program.

What does 'ls -l /sbin/skdet' show?

> not recognized...
> 
> if i try to start it locally with sudo i get the following.
> 
> sudo: unable to execute /sbin/skdet: No such file or directory
> 
So it looks like /sbin/skdet isn't there.

> i think i need to compile it for my x86_64 system, but i dont know how :D
> 
Nothing special required. When you built skdet you did run 'make clean'
first though, before running 'make', didn't you? I have skdet running on
x86_64 with no problems.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: Joh...@pl...       Fax: +44 (0)1752 587001