[Rkhunter-announce] The Rootkit Hunter project team announces release 1.3.4

[<un...@hu...>]

The Rootkit Hunter project team is happy to announce release 1.3.4.
 
The change log lists 4 additions, 8 changes and 9 bugfixes.
 New:
 - Added IntoXonia-NG rootkit check.
 - Added Vampire rootkit check.
 - Added support for TCB shadow files.
 - Added Phalanx2 rootkit check.

 Changes:
 - The MAIL-ON-WARNING option must now exist in the configuration 
file. This
   avoids it being accidentally misspelt, and rkhunter then not 
notifying the
   user of any warnings.
 - The DBDIR directory can now be read-only, after installation, 
provided that
   neither of the '--propupd' or '--update' options are specified, 
and that the
   '--versioncheck' option is not specified if ROTATE_MIRRORS is 
set to 1 in the
   configuration file.
 - Renamed the cron job file created by the RPM spec file from '01-
rkhunter' to
   'rkhunter'. This will then run 'rkhunter' after a prelink cron 
job (if one exists),
   and avoid some of the 'run prelink' errors.
 - The system startup file and directory tests have now been 
merged. The configuration
   file options LOCAL_RC_PATH and SYSTEM_RC_DIR have been replaced 
by the
   STARTUP_PATHS option, but, for compatability, they will still be 
recognised.
 - The ALLOWPROCDELFILE configuration option, used to whitelist 
specific processes
   from the deleted files test, can now be followed by a colon-
separated list
   of pathnames. The given process will then only be whitelisted if 
it is using
   one of the given pathnames.
 - The '--propupd' option can now take an optional file, directory 
or package name
   after it. The argument can be a list of names. When used, then 
only the given
   file names will be updated in the rkhunter.dat file. Hopefully 
this will make
   things a bit quicker on slower machines. See the man page for 
more details. If
   using a package manager, then you must run 'rkhunter --propupd' 
first.
 - The Linux 'os_specific' test has now been split into two 
separate tests -
   'loaded_modules' and 'avail_modules'. The tests, however, are 
the same as
   before, they check the currently loaded kernel modules and the 
names of the
   available modules. A new configuration file option has been 
added, called
   MODULES_DIR, so that users can specify which directory, and sub-
directories,
   are checked for bad module names, should rkhunter be unable to 
work out the
   correct location.
 - The pathname of the debug file, if used, is now written to the 
log file.

 Bugfixes:
 - Cater for when ROOTDIR is explicitly set to '/'.
 - Added an infinite loop check to the readlink.sh supplied script -
 only 64 levels
   of symbolic links are allowed now. Also cater better for top-
level names and
   links, and file names with spaces.
 - Improved the rsyslog remote logging check.
 - The wrong error message was shown if the English (en) language 
file was missing.
 - The hidden files and directories check wasn't checking for 
directories!
 - Improved the O/S name detection. Previously the lsb-release file 
would have
   preference to any other file. This could result in some 
gibberish being given as
   the O/S name, rather than continuing to look for other release 
files. This has
   now been fixed.
 - The tests against the SSH configuration file now accept the 
key/value pair to be
   separated by an equals sign as well as spaces and/or tabs.
 - The file properties inode check did not work correctly when used 
on non-prelinked
   systems with the RPM package manager. The test is now only 
performed when
   prelinking is not being used, and the inode data is always 
obtained from the disk.
   This is a partial fix, as the test should run for scripts 
regardless of whether
   prelinking is used or not.
 - The debug file is now created with a random name, and the file 
permissions are
   set to 600.

Thanks to John Horne and all contributors who made this release 
possible by providing code, submitting ideas, bugs, fixes, 
documentation, helping out on the rkhunter-users mailing list and 
promoting Rootkit Hunter.


Best regards, unSpawn
---

--
Click to become a master chef, own a restaurant and make millions.
 http://tagline.hushmail.com/fc/PnY6qxtWo9Lt3X2vcuhAup43MqOZEqDTNb9C8hheSCG9OZNf7aWF1/