Re: [Rkhunter-users] Fresh install FC6

[John H. <joh...@pl...>]

On Fri, 2006-12-22 at 19:28 -0800, Mark Ness wrote:
> I just installed FC6 and ran RKH (1.2.9) and got no default hashes.
> [Performing 'known good' check...
> Info: Check skipped - no hashes available]
> I didn't know if the same rules applied as for FC5, but I tried
> #setenforce 0
> #/etc/crond.daily/prelink
> #./hashupd.sh
> and I check /usr/local/rkhunter/lib/rkhunter/db, and the os.dat get's
> updated but the defaulthashes.dat remains the original timestamp, and
> I still get 0 hashes checked.
> 
> Also, RKH --update returns
> [Mirrorfile /usr/local/rkhunter/lib/rkhunter/db/mirrors.dat rotated
> Using mirror http://rkhunter.sourceforge.net
> [DB] Mirror file                      : Up to date
> [DB] MD5 hashes system binaries       : Up to date
> [DB] Operating System information     : ERROR
> Fatal error: no valid version tag in filename
> 
There's the problem. With no os.dat data RKH cannot check the file
hashes. I would suggest you modify your os.dat file to make the first
line something like 'version=0000000000', and then run 'rkhunter
--update' to get the latest version.


John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839