Re: [Rkhunter-users] fedora guide

[John H. <joh...@pl...>]

On Sat, 2013-01-12 at 16:12 +0200, George Tataetis wrote:
> So, guys
> 
> I 've written in my blog a guide for installing rkhunter in fedora here 
> https://sanctas1mpl1c1ta.wordpress.com/2013/01/12/rkhunter-in-fedora/. 
> But it's not as much so as to inform others, as for me to learn. Can 
> anyone check it, and point some guidelines if anything is wrong?
>
Hello,

Generally it is okay. However, some things to note:

1) There is no need to uncomment the HASH_FUNC setting in the config
file. RKH will look for a SHA1 command be default.

2) There is no need to uncomment the BINDIR setting specifying
'/usr/local/bin' and '/usr/local/sbin', as these are used by RKH by
default.

3) Do NOT uncomment the SCRIPTDIR setting, unless you are going to
change it. The setting will be automatically determined by the
installer, and the correct setting will be placed at the end of the
configuration file. (If you installed RKH somewhere else (in / say), and
then set SCRIPTDIR to '/usr/local/lib/rkhunter/scripts' some things will
probably fail.)

4) If you are using an RPM based system, then you can tell RKH to use
the RPM package manager by setting 'PKGMGR=RPM'. This has the advantage
that updates to packages (programs etc) will be checked against the RPM
database. Without this (that is, not using PKGMGR), you will receive
warnings for the files which have changed and have to run 'rkhunter
--propupd' whenever a package is updated.

The RPM package manager can check quite a few things, whereas the other
supported package managers generally only check the checksum of files.
RPM can check not only the checksums, but also file permissions, file
ownership, inode number, file size, modification time and so on. (See
'man rpm'.)






John.

-- 
John Horne, Plymouth University, UK
Tel: +44 (0)1752 587287    Fax: +44 (0)1752 587001