rkhunter Rootkit detection tool

1.4.6 security =31 1.4.6Version of this port present on the latest quarterly branch.

Maintainer: lukasz@wasikowski.net

Port Added: 2004-05-15 14:01:40

Last Update: 2019-10-12 08:37:02

SVN Revision: 514322

People watching this port, also watch: wget, unzip, libiconv, gmake, expat

License: GPLv2+

Description:

Rootkit Hunter is scanning tool to ensure you for about 99.9% you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like: - MD5/SHA1 hash compare - Look for default files used by rootkits - Wrong file permissions for binaries - Look for suspected strings in LKM and KLD modules - Look for hidden files - Optional scan within plaintext and binary files WWW: http://rkhunter.sourceforge.net

SVNWeb : Homepage

pkg-plist: as obtained via: make generate-plist

Expand this list (54 items)

Collapse this list.

1. /usr/local/share/licenses/rkhunter-1.4.6/catalog.mk
2. /usr/local/share/licenses/rkhunter-1.4.6/LICENSE
3. /usr/local/share/licenses/rkhunter-1.4.6/GPLv2+
4. bin/rkhunter
5. etc/periodic/security/415.rkhunter
6. @sample etc/rkhunter.conf.sample
7. lib/rkhunter/scripts/check_modules.pl
8. lib/rkhunter/scripts/filehashsha.pl
9. lib/rkhunter/scripts/readlink.sh
10. lib/rkhunter/scripts/stat.pl
11. man/man8/rkhunter.8.gz
12. var/lib/rkhunter/db/backdoorports.dat
13. @sample var/lib/rkhunter/db/i18n/cn.sample
14. @sample var/lib/rkhunter/db/i18n/de.sample
15. @sample var/lib/rkhunter/db/i18n/en.sample
16. @sample var/lib/rkhunter/db/i18n/tr.sample
17. @sample var/lib/rkhunter/db/i18n/tr.utf8.sample
18. @sample var/lib/rkhunter/db/i18n/zh.sample
19. @sample var/lib/rkhunter/db/i18n/zh.utf8.sample
20. @sample var/lib/rkhunter/db/i18n/ja.sample
21. @sample var/lib/rkhunter/db/mirrors.dat.sample
22. @sample var/lib/rkhunter/db/programs_bad.dat.sample
23. var/lib/rkhunter/db/signatures/RKH_BillGates.ldb
24. var/lib/rkhunter/db/signatures/RKH_Glubteba.ldb
25. var/lib/rkhunter/db/signatures/RKH_MMD-0028-2014.ldb
26. var/lib/rkhunter/db/signatures/RKH_dso.ldb
27. var/lib/rkhunter/db/signatures/RKH_iptablex.ldb
28. var/lib/rkhunter/db/signatures/RKH_jynx.ldb
29. var/lib/rkhunter/db/signatures/RKH_kbeast.ldb
30. var/lib/rkhunter/db/signatures/RKH_libkeyutils.ldb
31. var/lib/rkhunter/db/signatures/RKH_libkeyutils1.ldb
32. var/lib/rkhunter/db/signatures/RKH_libncom.ldb
33. var/lib/rkhunter/db/signatures/RKH_pamunixtrojan.ldb
34. var/lib/rkhunter/db/signatures/RKH_shv.ldb
35. var/lib/rkhunter/db/signatures/RKH_sniffer.ldb
36. var/lib/rkhunter/db/signatures/RKH_sshd.ldb
37. var/lib/rkhunter/db/signatures/RKH_turtle.ldb
38. var/lib/rkhunter/db/signatures/RKH_xsyslog.ldb
39. var/lib/rkhunter/db/suspscan.dat
40. @postunexec rm -f %D/var/lib/rkhunter/db/rkhunter_prop_list.dat 2> /dev/null || true
41. @postunexec rm -f %D/var/lib/rkhunter/db/rkhunter.dat* 2> /dev/null || true
42. @comment var/lib/rkhunter/tmp/group
43. @comment var/lib/rkhunter/tmp/passwd
44. @postexec cp /etc/passwd %D/var/lib/rkhunter/tmp/passwd 2> /dev/null || true
45. @postunexec rm -f %D/var/lib/rkhunter/tmp/passwd 2> /dev/null || true
46. @postexec cp /etc/group %D/var/lib/rkhunter/tmp/group 2> /dev/null || true
47. @postunexec rm -f %D/var/lib/rkhunter/tmp/group 2> /dev/null || true
48. @dir(,,0750) lib/rkhunter/scripts
49. @dir(,,0750) lib/rkhunter
50. @dir(,,0750) var/lib/rkhunter/db/i18n
51. @dir(,,0750) var/lib/rkhunter/db/signatures
52. @dir(,,0750) var/lib/rkhunter/db
53. @dir(,,0750) var/lib/rkhunter/tmp
54. @dir(,,0750) var/lib/rkhunter

Collapse this list.

Dependency lines:

• rkhunter>0:security/rkhunter

To install the port: cd /usr/ports/security/rkhunter/ && make install clean

To add the package: pkg install rkhunter

PKGNAME: rkhunter

Flavors: there is no flavor information for this port.

distinfo:

TIMESTAMP = 1539368101 SHA256 (rkhunter-1.4.6.tar.gz) = f750aa3e22f839b637a073647510d7aa3adf7496e21f3c875b7a368c71d37487 SIZE (rkhunter-1.4.6.tar.gz) = 302137

Dependencies

NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.

Build dependencies:

1. perl5>=5.30.r1<5.31 : lang/perl5.30

Runtime dependencies:

1. p5-Digest-SHA1>=0 : security/p5-Digest-SHA1
2. lsof : sysutils/lsof
3. perl5>=5.30.r1<5.31 : lang/perl5.30

There are no ports dependent upon this port

Configuration Options

===> The following configuration options are available for rkhunter-1.4.6: DOCS=on: Build and/or install documentation LSOF=on: LiSt Open Files utility support NMAP=off: NMAP security scanning support ===> Use 'make config' to modify these settings

USES:

perl5 shebangfix

pkg-message:

If installing:

You should keep your rkhunter database up-to-date. This can be done automatically by putting this line to periodic.conf(5) files: daily_rkhunter_update_enable="YES" daily_rkhunter_update_flags="--update --nocolors" Also, you can run rkhunter as a part of the daily security check by putting this line to periodic.conf(5) files: daily_rkhunter_check_enable="YES" daily_rkhunter_check_flags="--checkall --nocolors --skip-keypress"

Master Sites:

Expand this list (26 items)

Collapse this list.
1. http://cytranet.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
2. http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
3. http://excellmedia.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
4. http://freefr.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
5. http://jaist.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
6. http://kent.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
7. http://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
8. http://netcologne.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
9. http://netix.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
10. http://superb-dca2.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
11. http://superb-sea2.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
12. http://ufpr.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
13. http://vorboss.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
14. https://cytranet.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
15. https://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
16. https://excellmedia.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
17. https://freefr.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
18. https://jaist.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
19. https://kent.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
20. https://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
21. https://netcologne.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
22. https://netix.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
23. https://superb-dca2.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
24. https://superb-sea2.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
25. https://ufpr.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
26. https://vorboss.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.6/
Collapse this list.

security/rkhunter: Update to 1.4.6

Some files can be updated when running rkhunter.  Do not track them
in the plist.

Changes:	https://sourceforge.net/p/rkhunter/rkh_code/ci/version-1.4.6/tree/files/CHANGELOG
PR:		227837
Submitted by:	lukasz@wasikowski.net (maintainer)

Convert to UCL & cleanup pkg-message (categories s)

security/rkhunter: Update to 1.4.4

While here, improve LICENSE

Changes:	http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/CHANGELOG

PR:		220765
Submitted by:	Lukasz Wasikowski <lukasz@wasikowski.net> (maintainer)
Approved by:	garga (mentor, implicit)

* Add fetch function to rkhunter
* Remove wget as a dependency
* Added NO_ARCH
* Fixed portlint items

PR:		219825
Submitted by:	Helge Oldach <freebsd@oldach.net>
Reviewed by:	matthew (mentor)
Approved by:	Lukasz Wasikowski <lukasz@wasikowski.net> (maintainer), matthew
(mentor)
Differential Revision:	https://reviews.freebsd.org/D11168

Use anticongestion in security/rkhunter

Introduced in src r316342, the anticongestion feature unifies multiple periodic
scripts' disparate sleeps.

PR:		218446
Submitted by:	lukasz@wasikowski.net
Reported by:	asomers
Reviewed by:	asomers
Approved by:	Lukasz Wasikowski <lukasz@wasikowski.net> (maintainer)
Approved by:	brd (ports)

When there is a do-install target, do not use a post-install target, do
everything at once.  Sometime, rename post-install into a options helper
target.

I did not fix ports that were such a mess that I could not figure out
what they really wanted to do.  I also did not change ports that had
some version of an auto-plist code in post-install, for the same reason.

With hat:	portmgr
Sponsored by:	Absolight

Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight

- Fix shebangs

Approved by:	portmgr blanket
MFH:		2015Q3 (blanket)

Cleanup plist

- unbreak
- added some FreeBSD defaults regarding SSH
- made port more PREFIX aware
- changed maintainer

PR:		191842
Submitted by:	Gerard J. Cerchio and Lukasz Wasikowski (maintainer)

- Reset maintainership

1.4.0 was unfetchable and the website advises everyone to
"upgrade real soon now." So, update the port to 1.4.2.

Also, STAGE support, options helpers, @sample, etc.

- Fix checksum mismatch problem during updates by installing signatures as
sample

PR:		ports/182789
Submitted by:	pirzyk

Fix properties on pkg-plist

Add NO_STAGE all over the place in preparation for the staging support (cat:
security)

Convert to new perl framework
Convert USE_GMAKE to USES=gmake

- Convert to new option framework

- Update to 1.4.0
- Make portlint happy

- Remove SITE_PERL from *_DEPENDS

Approved by: portmgr@ (bapt@)

- Install sample configuration file
- Add LICENSE

PR:             ports/153024
Submitted by:   Trond Endrestøl <Trond.Endrestol at ximalas.info>
Approved by:    jadawin@ (mentor)

Update my MAINTAINER address to sbz at FreeBSD.org.

Approved by:    jadawin@ (mentor)

Remove former maintainer from pkg-desr at their request

Feature safe:   yes

- Really give maintainership to Sofian Brabez.

Pointyhat to:   jadawin@ (myself)

- Update to 1.3.8
- Submitter is now maintainer

PR:             ports/152607
Submitted by:   Sofian Brabez <sbrabez AT gmail.com>

- Update to 1.3.6 [1]

PR:             ports/142962
Submitted by:   Sergiy Borodych <bor univ.kiev.ua>
[1] Done by:    jadawin@ (myself)

- Pass maintainership to jadawin

- Fix build

Reported by:    pavbot

- Fix warning output

PR:             132541
Submitted by:   Lukasz Wasikowski <lukasz@wasikowski.net>

- Update to 1.3.4
- Take over maintainership

Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)

- Update to 1.3.2

PR:             123204
Submitted by:   Lukasz Wasikowski <lukasz@wasikowski.net>
Approved by:    maintainer implicit

* Use the option --nocolors to make daily report pretty.
* Remove the option --cronjob to show the result in daily report.

PR:             119130
Submitted by:   Yi-Huan Chan <yhchan@csie.nctu.edu.tw>
Approved by:    maintainer via mail

- Update to 1.3.0

PR:             117269
Submitted by:   Philippe Audeoud <jadawin@tuxaco.net>
Approved by:    maintainer implicit

- Updatet to 1.2.9

Approved by:    maintainer (implicit)

Change my email address to farrokhi@ in all ports that I maintain.
Approved by:    miwi (mentor)

- Update mastersite.
- Pass maintainership to submitter.

PR:             ports/102933
Submitted by:   Babak Farrokhi <babak@farrokhi.net>

- Add periodic script to ease the maintenance
- Bump PORTREVISION

PR:             102968
Submitted by:   Gabor Kovesdan <gabor@FreeBSD.org>

Reset inactive maintainer who has not responded to email.

Hat:            portmgr

Now builds on sparc64

Approved by:    maintainer timeout (7+ weeks)

- Add OPTIONS for nmap (default on) and lsof (default off) RUN_DEPENDs for
additional checks
- bump portrevision

PR:             ports/99432
Submitted by:   Babak Farrokhi <babak@farrokhi.net>
Approved by:    maintianer timeout

- Preserv .conf file.
- Bump PORTREVISION

PR:             95553
Reported by:    Torfinn Ingolfsen <torfinn.ingolfsen___broadpark.no>
Approved by:    maintainer timeout (19 days)

- Update to 1.2.8
- Pacify portlint

PR:             93340
Submitted by:   Babak Farrokhi <babak@farrokhi.net>
Approved by:    vaidab <vaidab@Safe-mail.net> (maintainer)

SHA256ify

Approved by: krion@

update port security/rkhunter

        - Removed an obselete patch
        - Add pkg-message to show database update notice

PR:             ports/90737
Submitted by:   Babak Farrokhi <babak@farrokhi.net>

Change maintainer's email

PR:             88352
Submitted by:   vaidab <vaidab@phenix.rootshell.be> (maintainer)

Add support for FreeBSD 5.4.

PR:             82370
Submitted by:   Babak Farrokhi <babak (at) farrokhi.net>
Approved by:    maintainer time-out (> 15 days)

Fix dependency and remove the ancient pkg-message.

PR:             82336
Submitted by:   Babak Farrokhi <babak (at) farrokhi.net>
Approved by:    maintainer time-out (> 15 days)

Change MAINTAINER email back from babak@farrokhi.net to
vaidab@safe-mail.net. This was mistakenly changed during
yesterdays patch.

Approved by:    nectar (mentor)

Upgrade to version 1.2.7

PR:             ports/82193
Submitted by:   Babak Farrokhi
Approved by:    nectar (mentor)

Update to 1.2.3

Submitted by:   maintainer
PR:             ports/79149

BROKEN on sparc64: Does not build

Approved by:    portmgr (self)

- Update to 1.1.9

PR:             ports/76699
Submitted by:   bugghy <vaidab@safe-mail.net> (maintainer)

Update to 1.1.8.

Note to maintainer: your mailer is apparently changing tabs to spaces.
For short patches like this, it's possible to work around it; for
longer patches, it won't work at all.

PR:             ports/71680
Submitted by:   bugghy <bugghy at rootshell dot be> ( maintainer)

- Update to 1.1.7

PR:             ports/71119
Submitted by:   bugghy <bugghy@rootshell.be> (maintainer)

Upgrade to 1.1.4.

PR:             ports/70149
Submitted by:   maintainer.

. Add support for FreeBSD 4.10.

PR:             69614
Submitted by:   Yonatan <yonatan@xpert.com>

- Update to 1.1.3

PR:             ports/69574
Submitted by:   bugghy <bugghy@rootshell.be>

Add rkhunter 1.0.8,

Rootkit Hunter is scanning tool to ensure you for about 99.9%
you're clean of nasty tools.

This tool scans for rootkits, backdoors and local exploits by
running tests like:

- MD5/SHA1 hash compare
- Look for default files used by rootkits
- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plaintext and binary files

PR:             ports/66660
Submitted by:   Radim Kolar <hsn at netmag dot cz>

9 vulnerabilities affecting 118 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities

Last updated:
2020-10-22 09:39:08