FreshPorts -- security/rkhunter

Rootkit Hunter is scanning tool to ensure you for about 99.9% you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like: - MD5/SHA1 hash compare - Look for default files used by rootkits - Wrong file permissions for binaries - Look for suspected strings in LKM and KLD modules - Look for hidden files - Optional scan within plaintext and binary files WWW: http://rkhunter.sourceforge.net

pkg-plist

make generate-plist

Expand this list (50 items)

/usr/local/share/licenses/rkhunter-1.4.4/catalog.mk

/usr/local/share/licenses/rkhunter-1.4.4/LICENSE

/usr/local/share/licenses/rkhunter-1.4.4/GPLv2+

bin/rkhunter

etc/periodic/security/415.rkhunter

@sample etc/rkhunter.conf.sample

lib/rkhunter/scripts/check_modules.pl

lib/rkhunter/scripts/filehashsha.pl

lib/rkhunter/scripts/readlink.sh

lib/rkhunter/scripts/stat.pl

man/man8/rkhunter.8.gz

var/lib/rkhunter/db/backdoorports.dat

var/lib/rkhunter/db/i18n/cn

var/lib/rkhunter/db/i18n/de

var/lib/rkhunter/db/i18n/en

var/lib/rkhunter/db/i18n/tr

var/lib/rkhunter/db/i18n/tr.utf8

var/lib/rkhunter/db/i18n/zh

var/lib/rkhunter/db/i18n/zh.utf8

var/lib/rkhunter/db/i18n/ja

@sample var/lib/rkhunter/db/mirrors.dat.sample

@sample var/lib/rkhunter/db/programs_bad.dat.sample

var/lib/rkhunter/db/signatures/RKH_BillGates.ldb

var/lib/rkhunter/db/signatures/RKH_Glubteba.ldb

var/lib/rkhunter/db/signatures/RKH_MMD-0028-2014.ldb

var/lib/rkhunter/db/signatures/RKH_dso.ldb

var/lib/rkhunter/db/signatures/RKH_iptablex.ldb

var/lib/rkhunter/db/signatures/RKH_jynx.ldb

var/lib/rkhunter/db/signatures/RKH_kbeast.ldb

var/lib/rkhunter/db/signatures/RKH_libkeyutils.ldb

var/lib/rkhunter/db/signatures/RKH_libkeyutils1.ldb

var/lib/rkhunter/db/signatures/RKH_libncom.ldb

var/lib/rkhunter/db/signatures/RKH_pamunixtrojan.ldb

var/lib/rkhunter/db/signatures/RKH_shv.ldb

var/lib/rkhunter/db/signatures/RKH_sniffer.ldb

var/lib/rkhunter/db/signatures/RKH_sshd.ldb

var/lib/rkhunter/db/signatures/RKH_turtle.ldb

var/lib/rkhunter/db/signatures/RKH_xsyslog.ldb

var/lib/rkhunter/db/suspscan.dat

@postunexec rm -f %D/var/lib/rkhunter/db/rkhunter_prop_list.dat 2> /dev/null || true

@postunexec rm -f %D/var/lib/rkhunter/db/rkhunter.dat* 2> /dev/null || true

var/lib/rkhunter/tmp/group

var/lib/rkhunter/tmp/passwd

@dir(,,0750) lib/rkhunter/scripts

@dir(,,0750) lib/rkhunter

@dir(,,0750) var/lib/rkhunter/db/i18n

@dir(,,0750) var/lib/rkhunter/db/signatures

@dir(,,0750) var/lib/rkhunter/db

@dir(,,0750) var/lib/rkhunter/tmp

@dir(,,0750) var/lib/rkhunter

Collapse this list.

To install the port: cd /usr/ports/security/rkhunter/ && make install clean
To add the package: pkg install rkhunter

NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.

===> The following configuration options are available for rkhunter-1.4.4: DOCS=on: Build and/or install documentation LSOF=on: LiSt Open Files utility support NMAP=off: NMAP security scanning support ===> Use 'make config' to modify these settings

****************************************************************************** You should keep your rkhunter database up-to-date. This can be done automatically by putting this line to periodic.conf(5) files: daily_rkhunter_update_enable="YES" daily_rkhunter_update_flags="--update --nocolors" Also, you can run rkhunter as a part of the daily security check by putting this line to periodic.conf(5) files: daily_rkhunter_check_enable="YES" daily_rkhunter_check_flags="--checkall --nocolors --skip-keypress" ******************************************************************************

security/rkhunter: Update to 1.4.4 While here, improve LICENSE Changes: http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/CHANGELOG PR: 220765 Submitted by: Lukasz Wasikowski <lukasz@wasikowski.net> (maintainer) Approved by: garga (mentor, implicit)

* Add fetch function to rkhunter * Remove wget as a dependency * Added NO_ARCH * Fixed portlint items PR: 219825 Submitted by: Helge Oldach <freebsd@oldach.net> Reviewed by: matthew (mentor) Approved by: Lukasz Wasikowski <lukasz@wasikowski.net> (maintainer), matthew (mentor) Differential Revision: https://reviews.freebsd.org/D11168

Use anticongestion in security/rkhunter Introduced in src r316342, the anticongestion feature unifies multiple periodic scripts' disparate sleeps. PR: 218446 Submitted by: lukasz@wasikowski.net Reported by: asomers Reviewed by: asomers Approved by: Lukasz Wasikowski <lukasz@wasikowski.net> (maintainer) Approved by: brd (ports)

When there is a do-install target, do not use a post-install target, do everything at once. Sometime, rename post-install into a options helper target. I did not fix ports that were such a mess that I could not figure out what they really wanted to do. I also did not change ports that had some version of an auto-plist code in post-install, for the same reason. With hat: portmgr Sponsored by: Absolight

Bump portrevision due to upgrade of devel/gettext. The affected ports are the ones with gettext as a run-dependency according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT in Makefile (29 of them). PR: ports/124340 Submitted by: edwin@ Approved by: portmgr (pav)

* Use the option --nocolors to make daily report pretty. * Remove the option --cronjob to show the result in daily report. PR: 119130 Submitted by: Yi-Huan Chan <yhchan@csie.nctu.edu.tw> Approved by: maintainer via mail

- Add OPTIONS for nmap (default on) and lsof (default off) RUN_DEPENDs for additional checks - bump portrevision PR: ports/99432 Submitted by: Babak Farrokhi <babak@farrokhi.net> Approved by: maintianer timeout

update port security/rkhunter - Removed an obselete patch - Add pkg-message to show database update notice PR: ports/90737 Submitted by: Babak Farrokhi <babak@farrokhi.net>

Update to 1.1.8. Note to maintainer: your mailer is apparently changing tabs to spaces. For short patches like this, it's possible to work around it; for longer patches, it won't work at all. PR: ports/71680 Submitted by: bugghy <bugghy at rootshell dot be> ( maintainer)

Add rkhunter 1.0.8, Rootkit Hunter is scanning tool to ensure you for about 99.9% you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like: - MD5/SHA1 hash compare - Look for default files used by rootkits - Wrong file permissions for binaries - Look for suspected strings in LKM and KLD modules - Look for hidden files - Optional scan within plaintext and binary files PR: ports/66660 Submitted by: Radim Kolar <hsn at netmag dot cz>