| 1 |
On Sun, 9 Jul 2006 13:33:23 +0100, Dave S wrote: |
| 2 |
|
| 3 |
> I have written a script in /etc/cron.daily for chkrootkit to screen out |
| 4 |
> known suspect files that are OK & to email me with anthing else ... |
| 5 |
> (ahem its not a gentoo system ... just thought I should come clean :)) |
| 6 |
> |
| 7 |
> #!/bin/sh |
| 8 |
> |
| 9 |
> # Adds a primitive filter of repeating false positives |
| 10 |
> |
| 11 |
> OUTFILE=`mktemp` || exit 1 |
| 12 |
> |
| 13 |
> chkrootkit -q\ |
| 14 |
> | grep -v 'PACKET SNIFFER(/sbin/dhclient3'\ |
| 15 |
> | grep -v '/usr/lib/jvm/.java-gcj.jinfo'\ |
| 16 |
> | grep -v '/usr/lib/realplay-10.0.6/share/default/.realplayerrc'\ |
| 17 |
> | grep -v '/usr/lib/jvm/java-1.5.0-sun-1.5.0.06/.systemPrefs'\ |
| 18 |
> | grep -v '/usr/lib/jvm/.java-1.5.0-sun.jinfo'\ |
| 19 |
> | grep -v '/usr/lib/mindi/rootfs/root/.profile'\ |
| 20 |
> | grep -v '/usr/lib/mindi/rootfs/proc/.keep'\ |
| 21 |
> > $OUTFILE 2> /dev/null |
| 22 |
> |
| 23 |
> val1=$(wc -l < $OUTFILE) |
| 24 |
> |
| 25 |
> if [ $val1 -ge 3 ] ; then |
| 26 |
> cat $OUTFILE | mail -s "[ckrootkit] Daily run" root |
| 27 |
> fi |
| 28 |
> |
| 29 |
> rm -f $OUTFILE |
| 30 |
> |
| 31 |
> |
| 32 |
> All works as expected except the 2> /dev/null appears not to work. |
| 33 |
|
| 34 |
You are redirecting the output of grep, not chkrootkit. Try |
| 35 |
|
| 36 |
chkrootkit -q 2>/dev/null | grep -v -f chkroot.filter >$OUTFILE |
| 37 |
|
| 38 |
with the patterns in chkroot.filter (this won't affect the error you |
| 39 |
mentioned, but it makes things a lot easier to read). |
| 40 |
|
| 41 |
|
| 42 |
-- |
| 43 |
Neil Bothwick |
| 44 |
|
| 45 |
ISDN: It Still Does Nothing |
Archives