| View previous topic :: View next topic |
| Author |
Message |
sulek
n00b
Joined: 04 Jun 2005
Posts: 55
|
 Posted: Mon Jun 06, 2005 6:38 pm Post subject: Chkroot output |
 |
|
Hello guys,
I've just installed chkrootkit and discovered that fortunately my system is not compromised;)
Anyway, gentoo chkrootkit install script adds entry to cron.weekly. My question is where output messages of chkrootkit is stored. I hope not only in /var/log/message;)
Thanks is advance! |
|
| Back to top |
|
 |
giel
n00b
Joined: 12 May 2005
Posts: 6
|
| Posted: Mon Jun 06, 2005 8:31 pm Post subject: |
|
|
if you cat the chkrootkit script in your cron.weekly, you should see output similar to:
| Code: |
/usr/sbin/chkrootkit -q > /var/log/chkrootkit.log
|
By default, the log should be what is indicated above: /var/log/chkrootkit.log
If you want to change it, just modify what is to the right of the ">"
ex
| Code: |
/usr/sbin/chkrootkit -q > /home/user/chkrootkit.log
|
Not sure exactly how you would output to two different files (short of running chkrootkit twice) if that is what you're asking.
Grats on no rootkits ; ) |
|
| Back to top |
|
|
sulek
n00b
Joined: 04 Jun 2005
Posts: 55
|
| Posted: Mon Jun 06, 2005 8:57 pm Post subject: |
|
|
Actually I made it different. I put following script to crontab.daily:
/usr/sbin/chkrootkit -q|mail -s "Daily crontab" user@domain.com
Unfortunatelly one server don't have mail server and actually I don't want it to have due to security reasons.
I don't know how to tackle it  |
|
| Back to top |
|
|
giel
n00b
Joined: 12 May 2005
Posts: 6
|
| Posted: Mon Jun 06, 2005 11:54 pm Post subject: |
|
|
Your solution appears to work (tested on my system using sendmail and shooting off the message to my gmail account), however, if your machine doesn't have sendmail (or something similiar) sending via email won't really be an option.
I'm not sure what kind of security you're looking for. If you're just wanting to not use sendmail perhaps you can script something to output to a log file, use wput to upload the file to another machine? If you don't want the machine to keep the file, just remove the file via your script.
plausible? |
|
| Back to top |
|
|
|
Networking & Security
