Re: [Rkhunter-users] rkmetahunter / metarkhunter

[John H. <joh...@pl...>]

On Sat, 2012-04-07 at 17:25 +0200, Carel Fenijn wrote:
> Hi everyone,
> 
> I find rkhunter a very useful tool.
> 
> Now I wonder, before I re-invent the wheel, do any of you use it
> cross-server, i.e. of all servers S0, S1, S3, ... I know that the
> checksum of file F should be N. If it isn't on server S1, a
> warning is issued, something like that?
> 
> One reason why it could be different on server S1 is that a human
> mistakenly ran rkhunter --propupd.
> 
Hello,

No we don't do that. However, I would say beware if prelinking is used -
that will change the checksum. Even if you use a package manager, the
checksum may be different if not all servers are updated at the same
time.



John.

-- 
John Horne, Plymouth University, UK
Tel: +44 (0)1752 587287    Fax: +44 (0)1752 587001