A ports freeze means that commits will be few and far between and only by approval.

chkrootkit 0.48 security =117

A tool to locally check for signs of a rootkit
Maintained by: cordeiro@nic.br
Port Added: 06 Apr 2001 22:48:49

---

---

 Chkrootkit is a tool to locally check for signs of a rootkit.
 -------------------------------------------------------------

 It contains:

 * chkrootkit: a shell script that checks system binaries for
   rootkit modification.
 * ifpromisc.c: checks if the network interface is in promiscuous
   mode.
 * chklastlog.c: checks for lastlog deletions.
 * chkwtmp.c: checks for wtmp deletions.
 * check_wtmpx.c: checks for wtmpx deletions.  (Solaris only)
 * chkproc.c: checks for signs of LKM trojans.
 * chkdirs.c: checks for signs of LKM trojans.
 * strings.c: quick and dirty strings replacement.
 * chkutmp.c: checks for utmp deletions.

 For an updated list of rootkits, worms and LKMs detected by
 chkrootkit please visit: http://www.chkrootkit.org/

Nelson Murilo <nelson@pangeia.com.br>
Klaus Steding-Jessen <jessen@nic.br>

WWW: http://www.chkrootkit.org/

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

To install the port: cd /usr/ports/security/chkrootkit/ && make install clean
To add the package: pkg_add -r chkrootkit

---

Configuration Options

     No options to configure

---

Master Sites:

ftp://ftp.pangeia.com.br/pub/seg/pac/

ftp://gd.tuwien.ac.at/infosys/security/chkrootkit/

ftp://ftp.digitalvoodoo.org/pub/mirrors/chkrootkit/

http://www.spenneberg.org/chkrootkit-mirror/files/

http://www.mirrors.wiretapped.net/security/host-security/chkrootkit/

http://ftp.uni-stuttgart.de/pub/security/unix/forensics/chkrootkit/

http://ftp.bit.nl/mirror/chkrootkit/

http://chkrootkit.mirror.fr/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

No functional changes, just try to make Makefile a bit better:

- Remove conditional to set PORTDOCS
- s/pre-patch/post-patch/
- Change Makefile's reinplace to use ?= instead of comment CC and CFLAGS lines
  and remove MAKE_ENV declaration
- Remove redundances of program names, just set it one time and use the vars to
  repeat names

Approved by:    maintainer by email

- Respect CC

PR:             122941
Submitted by:   Frank Fenor <frank@fenor.de>
Approved by:    maintainer

- Update to 0.48
- Remove pre-everything (no more false positives)
- Remove patches (extra_patches and patch in files directory)

PR:             ports/118930
Submitted by:   Philippe Audeoud <jadawin tuxaco.net>
Approved by:    Luiz Eduardo Roncato Cordeiro <cordeiro nic.br> (maintainer)

- Update to 0.47

PR:             ports/105816
Submitted by:   Luiz Eduardo Roncato Cordeiro <cordeiro@cert.br> (maintainer)

Remove USE_REINPLACE from all categories starting with S

SHA256ify

Approved by: krion@

- Unbreak: Update to 0.46a

Approved by:    maintainer

chkproc sends a 25 signal to init causing a reboot after a 30s sleep

Mark it as BROKEN until the problem is fixed.

Submitted by:   maintainer (by email)

- Update to 0.46

Approved by:    maintainer

- Update to chkrookit version 0.45 [1]
- utilize PORTDOCS, DOCSDIR and PLIST_FILES

PR:             [1] 79865
Submitted by:   [1] Luiz Eduardo Roncato Cordeiro <cordeiro@nic.br>

- Update to 0.44

PR:             ports/71249
Submitted by:   Luiz Eduardo Roncato Cordeiro <cordeiro@nic.br> (maintainer)

- Mark IGNORE for now

PR:             ports/68726
Submitted by:   Luiz Eduardo Roncato Cordeiro <cordeiro@nic.br> (maintainer)

SIZEify (maintainer timeout)

Update to 0.43:

  C++ comments removed from chkproc.c.  New rootkits detected: AjaKit
  and zaRwT.  New CGI backdoors detected.  ifpromisc.c: better detection
  of promisc mode on newer Linux kernels.  New command line option
  (-n) to skip NFS mounted dirs. Minor bug corrections.

PR:             ports/62577
Submitted by:   Luiz E. R. Cordeiro <cordeiro@nic.br> (maintainer)

- Update to version 0.42b

PR:             57477
Submitted by:   maintainer

Update port: security/chkrootkit: upgrade to version 0.42

        Version upgrade from 0.41 to 0.42.
        It works on FreeBSD 2.2.X, 3.X, 4.X and 5.X.

PR:             ports/56757
Submitted by:   Luiz Eduardo Roncato Cordeiro <cordeiro@nic.br>

Teach security/chkrootkit

        I finnaly got fed up with that FAQ about chkrootkit. The
        solution was either to add a Q+A to the FAQ or fix the port.

        This introduce a new variable, FreeBSD5, that is set to
        "yes" if we're running FreeBSD 5 or higher.

        This variable is used to fix the tests of the following
        binaries, so they would DTRT on FreeBSD 5: chfn chsh date
        ls ps

        I also fixed a bug in the cheking of vdir, but it's irrelevant
        for FreeBSD.

Informed maintainer.

PR:             ports/55919
Submitted by:   Yonatan@xpert.com <Yonatan@xpert.com>

Mark IGNORE on 5.x: chkrootkit reports false positives

Inspired by:    Yet another "have I been hacked" email on questions@

Update to 0.41

PR:             53675
Submitted by:   maintainer
Approved by:    roberto (mentor)

Update to 0.40

PR: 50722
Submitted by: Michael L. Hostbaek <mich@freebsdcluster.org>

De-pkg-comment.

Update to 0.39a.

PR:             ports/47735
Submitted by:   Luiz Eduardo Roncato Cordeiro <cordeiro@luinil.nic.br>
                (maintainer)

Update to 0.38

PR:             ports/46952
Submitted by:   maintainer

PERL -> REINPLACE
Noticed on: bento

Upgrade to 0.37.

PR:             44468
Submitted by:   maintainer

Update to 0.36

PR:             ports/39475
Submitted by:   maintainer

Update to 0.35    

update to 0.34.    

Update to 0.32    

sorry for missing PR and submitter    

change WWW: to the real site    

Update to 0.31, lots of cleanup, add NOPORTDOCS handling.    

Fix checksum problem on bento by updating to 0.31.  Also start using the  
versioned distfiles since they are available.    

Add chkrootkit 0.30, a tool to locally check for signs of a rootkit.    

9 vulnerabilities affecting 22 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities