diff --git a/.cvsignore b/.cvsignore deleted file mode 100644 index e69de29..0000000 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0486fc1 --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +rkhunter-1.3.6.tar.gz +/rkhunter-1.3.8.tar.gz +/rkhunter-1.4.0.tar.gz +/rkhunter-1.4.2.tar.gz +/rkhunter-1.4.4.tar.gz +/rkhunter-1.4.6.tar.gz diff --git a/01-rkhunter b/01-rkhunter new file mode 100755 index 0000000..1e85c8e --- /dev/null +++ b/01-rkhunter @@ -0,0 +1,57 @@ +#!/bin/sh +# 01-rkhunter A shell script to update and run rkhunter via CRON + +XITVAL=0 + +# Get a secure tempfile +TMPFILE1=`/bin/mktemp -p /var/lib/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1 + +if [ ! -e /var/lock/subsys/rkhunter ]; then + + # Try to keep the SysInit boot scan from colliding with us (highly unlikely) + /bin/touch /var/lock/subsys/rkhunter + + # Source system configuration parameters. + if [ -e /etc/sysconfig/rkhunter ] ; then + . /etc/sysconfig/rkhunter + else + MAILTO=root@localhost + fi + + # If a diagnostic mode scan was requested, setup the parameters + if [ "$DIAG_SCAN" = "yes" ]; then + RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile" + else + RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only" + fi + + # Set a few critical parameters + RKHUNTER=/usr/bin/rkhunter + LOGFILE=/var/log/rkhunter/rkhunter.log + + # Run RootKit Hunter if available + if [ -x $RKHUNTER ]; then + /bin/echo -e "\n--------------------- Start Rootkit Hunter Update ---------------------" \ + > $TMPFILE1 + /bin/nice -n 10 $RKHUNTER --update --nocolors 2>&1 >> $TMPFILE1 + /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ----------------------" \ + >> $TMPFILE1 + /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1 + XITVAL=$? + /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -----------------------" \ + >> $TMPFILE1 + + if [ $XITVAL != 0 ]; then + /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)" $MAILTO + fi + /bin/cat $TMPFILE1 >> $LOGFILE + fi + + # Delete the gating lockfile + /bin/rm -f /var/lock/subsys/rkhunter +fi + +# Delete the secure tempfile +/bin/rm -f $TMPFILE1 + +exit $XITVAL diff --git a/Makefile b/Makefile deleted file mode 100644 index 0639c2d..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: rkhunter -# $Id$ -NAME := rkhunter -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Rootx && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/rkhunter-1.3.4.tar.gz.sha1.txt b/rkhunter-1.3.4.tar.gz.sha1.txt new file mode 100644 index 0000000..eb14540 --- /dev/null +++ b/rkhunter-1.3.4.tar.gz.sha1.txt @@ -0,0 +1,48 @@ +73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4 rkhunter-1.3.4/files/WISHLIST +c82074175e72642dd74322ce29281f0f2fe2798c rkhunter-1.3.4/files/programs_bad.dat +443431d6c4dde5ff474fc9521561c6858478ad81 rkhunter-1.3.4/files/rkhunter +59de768a09a4cd13599653df85ecc2362e416ab3 rkhunter-1.3.4/files/defaulthashes.dat +9203f315cf8ea90724f70595c0b8facd61169b4a rkhunter-1.3.4/files/i18n/cn +736fd9ea453f34c023a9ebed97fa0cea7461aeb8 rkhunter-1.3.4/files/i18n/zh.utf8 +3aa3999bd924382f2a7b7e52ad0c3f7834d2285c rkhunter-1.3.4/files/i18n/zh +a81ea7ee1677bb2f09c68ef55cac4819d102dfc0 rkhunter-1.3.4/files/i18n/en +ff10891d252f3859abe63054eb64f0e9eae2d781 rkhunter-1.3.4/files/tools/README +90876286c511986474144a5a1fc21afa0f5f29c5 rkhunter-1.3.4/files/tools/update_client.sh +e3ba269e33d5d385230d0a4457d87cf6e3acece8 rkhunter-1.3.4/files/tools/update_server.sh +98e225b334e319edaff76c079a3a241289ffa9c7 rkhunter-1.3.4/files/README +ebc05604eb51b10478d35ac3750699cefecd5ae3 rkhunter-1.3.4/files/filehashmd5.pl +d5bff919ce44a345a193824ea16b0404008d7823 rkhunter-1.3.4/files/programs_good.dat +beed9c4b594c5be28ca4837fdcd2ac367e2946ee rkhunter-1.3.4/files/contrib/run_rkhunter.sh +225cc53f9691ad39f10bd2aaac478355ce4dc411 rkhunter-1.3.4/files/contrib/README.txt +285155f63cfa7a6a73ec0352dccaaa2221989b94 rkhunter-1.3.4/files/contrib/rkhunter_remote_howto.txt +56bf42d4fe669412b84eb307d5e314af4501dc9a rkhunter-1.3.4/files/testing/stringscanner.sh +361ada5406c7e57e62e840caf3d3bce5e8436fc1 rkhunter-1.3.4/files/testing/rootkitinfo.txt +73e76916a3f65dde2317fff6c932e1d77760fdf7 rkhunter-1.3.4/files/testing/rkhunter.conf +1878119b6045eeab6a5afaebad7b523e86c3a935 rkhunter-1.3.4/files/filehashsha1.pl +a656a91b37a83a2325843f0ccedb5eb7866506ac rkhunter-1.3.4/files/mirrors.dat +9ddeec64999f4c0e6f9aa5992cd25c503311b764 rkhunter-1.3.4/files/backdoorports.dat +a0badd192cc4f33fbf38f446eae3c858ba81c88f rkhunter-1.3.4/files/check_modules.pl +82c8c3881d59d228de3ce74a4b7b68eac07940f1 rkhunter-1.3.4/files/md5blacklist.dat +4510d2228e144f80d75caef01c172095b2b4c24b rkhunter-1.3.4/files/rkhunter.conf +5c4319fe3f9acc552b7a9e973b7d081f7cb31642 rkhunter-1.3.4/files/check_port.pl +f50ab02e29a0f4eba0ebe698f2c750a3b0298009 rkhunter-1.3.4/files/CHANGELOG +951b498f71fc4a126ca435f7bce96ed8b821efb6 rkhunter-1.3.4/files/os.dat +996a29dee608374e601ecf0253e445e16506c672 rkhunter-1.3.4/files/check_update.sh +2e971f1c9f355d2172db3c5a33601b7037853ac1 rkhunter-1.3.4/files/FAQ +7fa41ed0dc8c95b48b04dab42f1eaf8031c6ce7c rkhunter-1.3.4/files/ACKNOWLEDGMENTS +5dfa5246dc1c87b05f44f9f444466ce3d0d6edec rkhunter-1.3.4/files/stat.pl +345ab306455525cf5626caadda22b5dcbf732bc1 rkhunter-1.3.4/files/LICENSE +5fc098260380362a515d32376e8d5522f1ccf716 rkhunter-1.3.4/files/readlink.sh +e158163bfe6cb414d839e91880af37611f8b5cc0 rkhunter-1.3.4/files/development/createfilehashes.pl +0c613880f3447af695ca9f9f93e158b34c2a10c3 rkhunter-1.3.4/files/development/osinformation.sh +7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff rkhunter-1.3.4/files/development/search_dead_sysmlinks.sh +d09ab61a3563122b8cd6415e3083dfe1ef285a2b rkhunter-1.3.4/files/development/i18nchk +cb4903c649ad50b79230f5a5250da82c1d9ccb0f rkhunter-1.3.4/files/development/createhashes.sh +4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1 rkhunter-1.3.4/files/development/rpmprelinkhashes.sh +6b2f032d6143ed3b6ba3eae19d7921e154e69e47 rkhunter-1.3.4/files/development/createhashesall.sh +614a5d3999055a8faeecc393c5695d628e5a7675 rkhunter-1.3.4/files/development/rpmhashes.sh +ec4d60774decbb354f7aafcc2b65b1f87e000c97 rkhunter-1.3.4/files/suspscan.dat +0b0c2b2b1e6342ada9b1df48cda550e5120f0cdf rkhunter-1.3.4/files/rkhunter.8 +43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306 rkhunter-1.3.4/files/showfiles.pl +21d8c152e81061d37d122e3a82283448cd267e73 rkhunter-1.3.4/files/rkhunter.spec +0093470e31268c538ecacc803969819faf742dde rkhunter-1.3.4/installer.sh diff --git a/rkhunter-1.4.6-Li0n-fix.patch b/rkhunter-1.4.6-Li0n-fix.patch new file mode 100644 index 0000000..e484db2 --- /dev/null +++ b/rkhunter-1.4.6-Li0n-fix.patch @@ -0,0 +1,13 @@ +diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6/files/rkhunter 2026-01-03 10:15:00.159046977 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2026-01-03 10:22:54.440297219 -0800 +@@ -8680,8 +8680,7 @@ + + + # Lion Worm +- LION_FILES="/bin/in.telnetd +- /bin/mjy ++ LION_FILES="/bin/mjy + /usr/man/man1/man1/lib/.lib/mjy + /usr/man/man1/man1/lib/.lib/in.telnetd + /usr/man/man1/man1/lib/.lib/.x diff --git a/rkhunter-1.4.6-drop-libkeyutils-check.patch b/rkhunter-1.4.6-drop-libkeyutils-check.patch new file mode 100644 index 0000000..b35ceaa --- /dev/null +++ b/rkhunter-1.4.6-drop-libkeyutils-check.patch @@ -0,0 +1,43 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2018-02-24 15:08:27.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-01-15 12:47:54.399665856 -0800 +@@ -8370,9 +8370,7 @@ + /lib/libsbr.so + /lib64/libsbr.so + /lib/libslr.so +- /lib64/libslr.so +- /lib/tls/libkeyutils.so.1 +- /lib64/tls/libkeyutils.so.1" ++ /lib64/libslr.so" + EBURY_DIRS= + EBURY_KSYMS= + +@@ -9762,10 +9760,6 @@ + file:/usr/share/sshd.sync:Trojaned SSH daemon + file:/bin/zcut:Trojaned SSH daemon + file:/usr/bin/zmuie:Trojaned SSH daemon +- file:/lib/libkeyutils.so.1.9:Sniffer component +- file:/lib64/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib64/libkeyutils.so.1.9:Sniffer component + file:/IptabLes:malware component + file:/.IptabLex:malware component + file:/boot/.IptabLex:malware component +@@ -9956,7 +9950,6 @@ + ssh-scan:Port scanner + atac:Port scanner component + \[pdflush\]:IRC bot +- libkeyutils.so.1.9:Spam tool component + .IptabLex:malware component + .IptabLes:malware component + .flush:malware component +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65 +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570 diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch new file mode 100644 index 0000000..143564d --- /dev/null +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -0,0 +1,220 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf +--- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter.conf 2022-06-11 09:58:09.740944517 -0700 +@@ -158,6 +158,7 @@ + # default directory beneath the installation directory. + # + #TMPDIR=/var/lib/rkhunter/tmp ++TMPDIR=/var/lib/rkhunter + + # + # This option specifies the database directory to use. +@@ -167,6 +168,7 @@ + # default directory beneath the installation directory. + # + #DBDIR=/var/lib/rkhunter/db ++DBDIR=/var/lib/rkhunter/db + + # + # This option specifies the script directory to use. +@@ -175,6 +177,7 @@ + # subsequently commented out or removed, then the program will not run. + # + #SCRIPTDIR=/usr/local/lib/rkhunter/scripts ++SCRIPTDIR=/usr/share/rkhunter/scripts + + # + # This option can be used to modify the command directory list used by rkhunter +@@ -231,7 +234,7 @@ + # + # The default value is '/var/log/rkhunter.log'. + # +-LOGFILE=/var/log/rkhunter.log ++LOGFILE=/var/log/rkhunter/rkhunter.log + + # + # Set this option to '1' if the log file is to be appended to whenever rkhunter +@@ -241,6 +244,7 @@ + # The default value is '0'. + # + #APPEND_LOG=0 ++APPEND_LOG=1 + + # + # Set the following option to '1' if the log file is to be copied when rkhunter +@@ -307,6 +311,7 @@ + # The default value is 'no'. + # + #ALLOW_SSH_ROOT_USER=no ++ALLOW_SSH_ROOT_USER=unset + + # + # Set this option to '1' to allow the use of the SSH-1 protocol, but note +@@ -321,6 +326,7 @@ + # The default value is '0'. + # + #ALLOW_SSH_PROT_V1=0 ++ALLOW_SSH_PROT_V1=2 + + # + # This setting tells rkhunter the directory containing the SSH configuration +@@ -353,7 +359,8 @@ + # program defaults. + # + ENABLE_TESTS=ALL +-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem + + # + # The HASH_CMD option can be used to specify the command to use for the file +@@ -435,6 +442,7 @@ + # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options. + # + #PKGMGR=NONE ++PKGMGR=RPM + + # + # It is possible that a file, which is part of a package, may have been +@@ -558,6 +566,17 @@ + # The default value is the null string. + # + #EXISTWHITELIST="" ++EXISTWHITELIST=/bin/ad ++# FreeIPA Certificate Authority ++EXISTWHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system ++# FreeIPA with KRA (Password Vault) ++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system ++# Some non default installed files we check ++EXISTWHITELIST=/usr/bin/GET ++EXISTWHITELIST=/usr/bin/whatis + + # + # Whitelist various attributes of the specified file. The attributes are those +@@ -588,6 +607,10 @@ + # The default value is the null string. + # + #SCRIPTWHITELIST=/usr/bin/groups ++SCRIPTWHITELIST=/usr/bin/whatis ++SCRIPTWHITELIST=/usr/bin/ldd ++SCRIPTWHITELIST=/usr/bin/groups ++SCRIPTWHITELIST=/usr/bin/GET + + # + # Allow the specified file to have the immutable attribute set. +@@ -630,6 +653,19 @@ + #ALLOWHIDDENDIR=/dev/.udev + #ALLOWHIDDENDIR=/dev/.udevdb + #ALLOWHIDDENDIR=/dev/.mdadm ++ALLOWHIDDENDIR="/etc/.java" ++ALLOWHIDDENDIR=/dev/.udev ++ALLOWHIDDENDIR=/dev/.udevdb ++ALLOWHIDDENDIR=/dev/.udev.tdb ++ALLOWHIDDENDIR=/dev/.static ++ALLOWHIDDENDIR=/dev/.initramfs ++ALLOWHIDDENDIR=/dev/.SRC-unix ++ALLOWHIDDENDIR=/dev/.mdadm ++ALLOWHIDDENDIR=/dev/.systemd ++ALLOWHIDDENDIR=/dev/.mount ++# for etckeeper ++ALLOWHIDDENDIR=/etc/.git ++ALLOWHIDDENDIR=/etc/.bzr + + # + # Allow the specified hidden file to be whitelisted. +@@ -645,6 +681,36 @@ + #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac + #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac + #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac ++ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz" ++ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac ++ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac ++ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac ++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac ++ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac ++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac ++ALLOWHIDDENFILE=/dev/.mdadm.map ++ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz ++ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz ++ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac ++# etckeeper ++ALLOWHIDDENFILE=/etc/.etckeeper ++ALLOWHIDDENFILE=/etc/.gitignore ++ALLOWHIDDENFILE=/etc/.bzrignore ++# systemd ++ALLOWHIDDENFILE=/etc/.updated ++# containers-common ++ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz ++# containers-common (older versions) ++ALLOWHIDDENFILE=/usr/share/man/man5/.dockerignore.5.gz + + # + # Allow the specified process to use deleted files. The process name may be +@@ -714,6 +780,37 @@ + # + #ALLOWDEVFILE=/dev/shm/pulse-shm-* + #ALLOWDEVFILE=/dev/shm/sem.ADBE_* ++ALLOWDEVFILE=/dev/shm/pulse-shm-* ++ALLOWDEVFILE=/dev/md/md-device-map ++# tomboy creates this one ++ALLOWDEVFILE="/dev/shm/mono.*" ++# created by libv4l ++ALLOWDEVFILE="/dev/shm/libv4l-*" ++# created by spice video ++ALLOWDEVFILE="/dev/shm/spice.*" ++# created by mdadm ++ALLOWDEVFILE="/dev/md/autorebuild.pid" ++# 389 Directory Server ++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats ++# squid proxy ++ALLOWDEVFILE=/dev/shm/squid-cf* ++# squid ssl cache ++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm ++# allow lldpad state file ++ALLOWDEVFILE=/dev/shm/lldpad.state ++# Allow PCS/Pacemaker/Corosync ++ALLOWDEVFILE=/dev/shm/qb-attrd-* ++ALLOWDEVFILE=/dev/shm/qb-cfg-* ++ALLOWDEVFILE=/dev/shm/qb-cib_rw-* ++ALLOWDEVFILE=/dev/shm/qb-cib_shm-* ++ALLOWDEVFILE=/dev/shm/qb-corosync-* ++ALLOWDEVFILE=/dev/shm/qb-cpg-* ++ALLOWDEVFILE=/dev/shm/qb-lrmd-* ++ALLOWDEVFILE=/dev/shm/qb-pengine-* ++ALLOWDEVFILE=/dev/shm/qb-quorum-* ++ALLOWDEVFILE=/dev/shm/qb-stonith-* ++# Allow podman ++ALLOWDEVFILE=/dev/shm/libpod*lock* + + # + # Allow the specified process pathnames to use shared memory segments. +@@ -1090,6 +1187,11 @@ + # + #RTKT_DIR_WHITELIST="" + #RTKT_FILE_WHITELIST="" ++RTKT_FILE_WHITELIST=/bin/ad ++# FreeIPA Certificate Authority ++RTKT_FILE_WHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system + + # + # The following option can be used to whitelist shared library files that would +@@ -1329,3 +1431,5 @@ + # The default value is '0'. + # + #GLOBSTAR=0 ++ ++INSTALLDIR="/usr" diff --git a/rkhunter-1.4.6-grep-fix.patch b/rkhunter-1.4.6-grep-fix.patch new file mode 100644 index 0000000..d9c2f78 --- /dev/null +++ b/rkhunter-1.4.6-grep-fix.patch @@ -0,0 +1,21 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2025-05-04 10:41:26.009520652 -0700 ++++ rkhunter-1.4.6/files/rkhunter 2025-05-04 10:37:49.439199695 -0700 +@@ -6691,7 +6691,7 @@ + # + + if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then +- if [ -n "`echo \"$FNAME\" | grep '^\/usr\/'`" ]; then ++ if [ -n "`echo \"$FNAME\" | grep '^/usr/'`" ]; then + RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'` + else + RKHTMPVAR3="/usr${FNAMEGREP}" +@@ -11005,7 +11005,7 @@ + # + + if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then +- if [ -n "`echo \"${FNAME}\" | grep '^\/usr\/'`" ]; then ++ if [ -n "`echo \"${FNAME}\" | grep '^/usr/'`" ]; then + RKHTMPVAR3=`echo "${FNAMEGREP}" | sed -e 's:^/usr::'` + else + RKHTMPVAR3="/usr${FNAMEGREP}" diff --git a/rkhunter-1.4.6-grep.patch b/rkhunter-1.4.6-grep.patch new file mode 100644 index 0000000..fb249b5 --- /dev/null +++ b/rkhunter-1.4.6-grep.patch @@ -0,0 +1,35 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2023-04-29 09:32:39.288709203 -0700 ++++ rkhunter-1.4.6/files/rkhunter 2023-04-29 10:00:29.396271053 -0700 +@@ -70,7 +70,7 @@ + # we exec to log everything to the debug file. + # + +-if [ -n "`echo \"$*\" | grep '\-\-debug'`" ]; then ++if [ -n "`echo \"$*\" | grep '\--debug'`" ]; then + RKHDEBUGFILE="" + RKHDEBUGBASE="/tmp/rkhunter-debug" + +@@ -181,9 +181,11 @@ + # used. If it is, then some typical grep tests will fail. + # + +-if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then ++# fedora always uses POSIX grep and set an alias here for depreciated egrep too ++#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then + alias grep='grep -E' +-fi ++ alias egrep='grep -E' ++#fi + + + # +@@ -9585,7 +9587,7 @@ + rpc.nfsd:tcp.log:Sniffer installed + sshd:/dev/ptyxx:OpenBSD Rootkit + sshd:/.config:SHV4 Rootkit +- sshd:+\\$.*\\$\!.*\!\!\\$:Backdoored SSH daemon installed ++ sshd:+\\$.*\\$!.*!!\\$:Backdoored SSH daemon installed + sshd:backdoor.h:Trojaned SSH daemon + sshd:backdoor_active:Trojaned SSH daemon + sshd:magic_pass_active:Trojaned SSH daemon diff --git a/rkhunter-1.4.6-journald-config.patch b/rkhunter-1.4.6-journald-config.patch new file mode 100644 index 0000000..f214af7 --- /dev/null +++ b/rkhunter-1.4.6-journald-config.patch @@ -0,0 +1,12 @@ +diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6/files/rkhunter 2026-01-03 10:15:00.159046977 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2026-01-03 10:18:12.190029798 -0800 +@@ -17615,7 +17615,7 @@ + # + + if [ -z "${SYSLOG_CONFIG_FILE}" ]; then +- SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf" ++ SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf /usr/lib/systemd/journald.conf" + fi + + if [ "${SYSLOG_CONFIG_FILE}" = "NONE" ]; then diff --git a/rkhunter-1.4.6-ssh.d.patch b/rkhunter-1.4.6-ssh.d.patch new file mode 100644 index 0000000..244279c --- /dev/null +++ b/rkhunter-1.4.6-ssh.d.patch @@ -0,0 +1,43 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2021-02-07 13:58:43.355270731 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-02-07 14:02:41.551554134 -0800 +@@ -17379,6 +17379,12 @@ + fi + done + ++ if [ -d "${SSH_CONFIG_FILE}.d" ];then ++ SSH_CONFIG_FILE="${SSH_CONFIG_FILE} ${SSH_CONFIG_FILE}.d/*" ++ else ++ : ++ fi ++ + if [ -n "${SSH_CONFIG_FILE}" ]; then + display --to SCREEN+LOG --type PLAIN --result FOUND --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE_SSH + +@@ -17396,7 +17402,7 @@ + # First we check for allowed root access. + # + +- RKHTMPVAR=`grep -i '^[ ]*PermitRootLogin[ =]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1` ++ RKHTMPVAR=`grep -ih '^[ ]*PermitRootLogin[ =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1` + + if [ -n "${RKHTMPVAR}" ]; then + # +@@ -17427,7 +17433,7 @@ + # Next we check to see if protocol version 1 is allowed. + # + +- RKHTMPVAR=`grep -i '^[ ]*Protocol[ =]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1` ++ RKHTMPVAR=`grep -i '^[ ]*Protocol[ =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1` + + if [ -n "${RKHTMPVAR}" ]; then + # +@@ -17467,7 +17473,7 @@ + # First check for the Ebury backdoor. + # + +- RKHTMPVAR=`grep -i '^[ ]*AuthorizedKeysFile[ =]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1` ++ RKHTMPVAR=`grep -i '^[ ]*AuthorizedKeysFile[ =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1` + + if [ -n "${RKHTMPVAR}" ]; then + RKHTMPVAR2=`echo ${RKHTMPVAR} | sed -e 's/^[^ =]*[ ]*=*[ ]*\([^ #]*\).*$/\1/'` diff --git a/rkhunter.spec b/rkhunter.spec new file mode 100644 index 0000000..aa2d9a2 --- /dev/null +++ b/rkhunter.spec @@ -0,0 +1,561 @@ +# In f20+ use unversioned docdirs, otherwise the old versioned one +%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} + +Name: rkhunter +Version: 1.4.6 +Release: 31%{?dist} +Summary: A host-based tool to scan for rootkits, backdoors and local exploits + +# Automatically converted from old format: GPLv2+ - review is highly recommended. +License: GPL-2.0-or-later +URL: http://rkhunter.sourceforge.net/ +Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz +Source2: 01-rkhunter +Source3: rkhunter.sysconfig +Patch0: rkhunter-1.4.6-fedoraconfig.patch +# libkeyutils is an actual legit library now, so this old check is a false positive. +Patch1: rkhunter-1.4.6-drop-libkeyutils-check.patch +# have ssh checks use the sshd.d directoy config files too. +Patch2: rkhunter-1.4.6-ssh.d.patch +# Fix grep/egrep changes in f38+ +Patch3: rkhunter-1.4.6-grep.patch +# Fix grep warning about escaping / in f42+ +Patch4: rkhunter-1.4.6-grep-fix.patch +# Fix systemd-journald config path +Patch5: rkhunter-1.4.6-journald-config.patch +# Fix false positive Li0n detection due to bin/sbin merge +Patch6: rkhunter-1.4.6-Li0n-fix.patch +BuildArch: noarch +BuildRequires: perl-generators + +Requires: coreutils, binutils, kmod, findutils, grep +Requires: e2fsprogs, procps, lsof, iproute, wget +Requires: perl-interpreter, perl(strict), perl(IO::Socket), s-nail, logrotate +Requires: crontabs + +%description +Rootkit Hunter (RKH) is an easy-to-use tool which checks +computers running UNIX (clones) for the presence of rootkits +and other unwanted tools. + +%prep + +%autosetup -p1 + +%{__cat} <<'EOF' >%{name}.logrotate +%{_localstatedir}/log/%{name}/%{name}.log { + weekly + notifempty + create 640 root root +} +EOF + +%build +# Nothing to be built + +%install +%{__rm} -rf $RPM_BUILD_ROOT + +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8 +%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n + +%{__install} -m755 -p files/%{name} ${RPM_BUILD_ROOT}%{_bindir}/ + +%{__install} -m644 -p files/backdoorports.dat ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/ +%{__install} -m644 -p files/mirrors.dat ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/ +%{__install} -m644 -p files/programs_bad.dat ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/ +%{__install} -m644 -p files/i18n/cn ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/ +%{__install} -m644 -p files/i18n/en ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/ + +%{__install} -m644 -p files/CHANGELOG ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__install} -m644 -p files/LICENSE ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__install} -m644 -p files/README ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__install} -m755 -p files/check_modules.pl ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/ +%{__install} -m644 -p files/*.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/ +# Don't ship these unless we want to Require the perl modules +#%{__install} -m750 -p files/filehashmd5.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ +#%{__install} -m750 -p files/filehashsha1.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ +%{__install} -m755 -p %{SOURCE2} ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/%{name} +%{__install} -m644 -p %{name}.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name} +%{__install} -m640 -p files/%{name}.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/ +%{__install} -m640 -p %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name} + +%files +%doc %{_pkgdocdir}/* +%{_bindir}/%{name} +%dir %{_datadir}/%{name} +%{_datadir}/%{name}/scripts +%{_sysconfdir}/cron.daily/%{name} +%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} +%dir %{_var}/lib/%{name} +%dir %{_var}/lib/%{name}/db +%ghost %{_var}/lib/%{name}/db/mirrors.dat +%ghost %{_var}/lib/%{name}/db/programs_bad.dat +%ghost %{_var}/lib/%{name}/db/backdoorports.dat +%{_var}/lib/%{name}/db/i18n +%dir %{_var}/log/%{name} +%config(noreplace) %{_sysconfdir}/%{name}.conf +%config(noreplace) %{_sysconfdir}/sysconfig/%{name} +%dir %{_pkgdocdir} +%{_mandir}/man8/* + +%changelog +* Sat Jan 03 2026 Kevin Fenzi - 1.4.6-31 +- Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203 +- Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304 + +* Fri Jul 25 2025 Fedora Release Engineering - 1.4.6-30 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sun May 04 2025 Kevin Fenzi - 1.4.6-29 +- Add fix for additional case of grep warnings with cron. + +* Sat Apr 19 2025 Kevin Fenzi - 1.4.6-28 +- Add a fix to grep warning about escaping /s. Fixes rhbz#2360502 + +* Sat Jan 18 2025 Fedora Release Engineering - 1.4.6-27 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Fri Jul 26 2024 Miroslav Suchý - 1.4.6-26 +- convert license to SPDX + +* Fri Jul 19 2024 Fedora Release Engineering - 1.4.6-25 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Fri Jan 26 2024 Fedora Release Engineering - 1.4.6-24 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 1.4.6-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Fri Jul 21 2023 Fedora Release Engineering - 1.4.6-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Apr 29 2023 Kevin Fenzi - 1.4.6-21 +- More complete fix for egrep changes. + +* Mon Apr 10 2023 Kevin Fenzi - 1.4.6-20 +- Patch grep/egrep changes to avoid warnings in F38+ + +* Fri Jan 20 2023 Fedora Release Engineering - 1.4.6-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 1.4.6-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sun Jun 19 2022 Kevin Fenzi - 1.4.6-17 +- Switch to using s-nail instead of mailx. + +* Sat Jun 11 2022 Kevin Fenzi - 1.4.6-16 +- Whitelist .dockerignore man page ( rhbz#2050551 ) + +* Fri Jan 21 2022 Fedora Release Engineering - 1.4.6-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Sat Nov 06 2021 Kevin Fenzi - 1.4.6-14 +- Add exclude for containers-common man page ( rhbz#2020015 ) + +* Fri Jul 23 2021 Fedora Release Engineering - 1.4.6-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Sun Feb 07 2021 Kevin Fenzi - 1.4.6-12 +- Fix bug around ssh protocol detection ( rhbz#1597635 ) + +* Wed Jan 27 2021 Fedora Release Engineering - 1.4.6-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Sat Jan 16 2021 Kevin Fenzi - 1.4.6-10 +- Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662 +- Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620 + +* Wed Jul 29 2020 Fedora Release Engineering - 1.4.6-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Sat May 16 2020 Kevin Fenzi - 1.4.6-8 +- Add allow for podman's /dev/shm files (fixes bug #1828698 ) + +* Thu Jan 30 2020 Fedora Release Engineering - 1.4.6-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sun Oct 06 2019 Kevin Fenzi - 1.4.6-6 +- Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593 + +* Fri Jul 26 2019 Fedora Release Engineering - 1.4.6-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Apr 14 2019 Kevin Fenzi - 1.4.6-4 +- Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920 + +* Sat Feb 02 2019 Fedora Release Engineering - 1.4.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sat Jul 14 2018 Fedora Release Engineering - 1.4.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Sun Feb 25 2018 Kevin Fenzi - 1.4.6-1 +- Update to 1.4.6. Fixes bug #1547315 +- Allow KRA vault log files. Fixes bug #1541472 +- ipc_shared_mem warning fixed upstream. Fixes bug #1524456 + +* Fri Feb 09 2018 Igor Gnatenko - 1.4.4-6 +- Escape macros in %%changelog + +* Mon Nov 27 2017 Kevin Fenzi - 1.4.4-5 +- Add fix for new rpm queryformat and ARCH. Fixes bug #1517387 + +* Sat Aug 12 2017 Kevin Fenzi - 1.4.4-4 +- Disable ipc_shared_mem test for now due to false positives. Bug #1472299 + +* Thu Jul 27 2017 Fedora Release Engineering - 1.4.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Thu Jul 13 2017 Petr Pisar - 1.4.4-2 +- perl dependency renamed to perl-interpreter + + +* Thu Jun 29 2017 Kevin Fenzi - 1.4.4-1 +- Update to 1.4.4. Fixes bug #1466318 +- Fix for logger and spaces. Fixes bug #1284403 + +* Sat Feb 11 2017 Fedora Release Engineering - 1.4.2-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Wed Jan 25 2017 Mukundan Ragavan - 1.4.2-12 +- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602 +- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130 + +* Wed Apr 20 2016 Kevin Fenzi - 1.4.2-11 +- Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059 + +* Thu Feb 04 2016 Fedora Release Engineering - 1.4.2-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Sun Dec 06 2015 Kevin Fenzi - 1.4.2-9 +- Add /dev/shm/squid files to whitelist. Fixes bug #1279632 + +* Tue Oct 13 2015 Mukundan Ragavan - 1.4.2-8 +- Change config patch to account for change in default SSH config + +* Thu Jun 18 2015 Fedora Release Engineering - 1.4.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Sat Dec 20 2014 Kevin Fenzi 1.4.2-6 +- Add /etc/.updated systemd file to whitelist. Fixes bug #1173481 +- Add patch to fix grep -a issue with too many arguments output. + +* Mon Oct 27 2014 Kevin Fenzi 1.4.2-5 +- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428 + +* Fri Sep 26 2014 Kevin Fenzi 1.4.2-4 +- Fix cron script to work with non bash shells. Fixes bug #1146717 + +* Sun Jun 08 2014 Fedora Release Engineering - 1.4.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sun Apr 06 2014 Kevin Fenzi 1.4.2-2 +- Add patch to fix ipcs command in non en locales +- Add config to fix freeipa installs. Fixes bug #994567 + +* Fri Mar 14 2014 Kevin Fenzi 1.4.2-1 +- Update to 1.4.2 + +* Sun Sep 01 2013 Kevin Fenzi 1.4.0-9 +- Add patch for now to help spaces in allowdev file handling. Fixes bug #984180 + +* Sat Aug 03 2013 Petr Pisar - 1.4.0-9 +- Perl 5.18 rebuild + +* Sat Jul 27 2013 Kevin Fenzi 1.4.0-8 +- Fix for unversioned docs +- Requires: crontabs. Fixes bug #989110 + +* Wed Jul 17 2013 Petr Pisar - 1.4.0-7 +- Perl 5.18 rebuild + +* Thu Feb 14 2013 Fedora Release Engineering - 1.4.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Sat Oct 06 2012 Kevin Fenzi 1.4.0-5 +- Add /dev/md/autorebuild.pid to whitelist. Fixes bug #857315 + +* Sat Aug 18 2012 Kevin Fenzi 1.4.0-4 +- Add /var/log/pki-ca/system to whitelist for FreeIPA. Fixes bug #849251 + +* Wed Aug 15 2012 Kevin Fenzi 1.4.0-3 +- Fix /bin/ad false positive. Fixes bug #831989 + +* Sat Jul 21 2012 Fedora Release Engineering - 1.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Tue May 08 2012 Kevin Fenzi - 1.4.0-1 +- Update to 1.4.0 + +* Sun Apr 15 2012 Kevin Fenzi - 1.3.8-15 +- Add workaround for /lib/java false positive. Fixes bug #806972 + +* Wed Feb 8 2012 Kay Sievers - 1.3.8-14 +- modutils are for Linux 2.4 and no longer provided; depend on kmod + +* Fri Jan 27 2012 Kevin Fenzi 1.3.8-13 +- Drop net-tools, no longer needed. Fixes bug #784803 +- Add /dev/shm/spice.* to whitelist. Fixes bug #784882 + +* Fri Jan 06 2012 Kevin Fenzi 1.3.8-12 +- Add /etc/.java to whitelist. Fixes bug #770972 + +* Fri Nov 25 2011 Kevin Fenzi - 1.3.8-11 +- Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. + +* Wed Oct 12 2011 Jim Pirzyk - 1.3.8-10 +- Update %%files section so that some .dat files are marked %%ghost + +* Fri Aug 05 2011 Kevin Fenzi - 1.3.8-9 +- Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524 + +* Fri Jul 08 2011 Kevin Fenzi - 1.3.8-8 +- Fix typo + +* Fri Jul 08 2011 Kevin Fenzi - 1.3.8-7 +- Add patch to fix out of the box warning on rkhunter script. +- Fixes bug #719270 +- Add etckeeper and tomboy files. Fixes bug #719265 and #719259 + +* Tue Jun 21 2011 Kevin Fenzi - 1.3.8-6 +- Change ssh check back to 2 - bug #596775 +- Drop hard Requires on prelink. It will be used if present - bug #714067 + +* Thu Apr 21 2011 Kevin Fenzi - 1.3.8-5 +- Add /dev/.mount to ALLOW_HIDDENDIR - bug #697599 + +* Wed Apr 13 2011 Kevin Fenzi - 1.3.8-4 +- Don't send warning emails anymore. They cause selinux issues and are not very helpful. +- Fixes bug #660544 + +* Wed Feb 09 2011 Fedora Release Engineering - 1.3.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Tue Dec 07 2010 Kevin Fenzi - 1.3.8-2 +- Adjust config some - bug #596775 + +* Fri Nov 26 2010 Kevin Fenzi - 1.3.8-1 +- Update to 1.3.8 + +* Wed Nov 24 2010 Kevin Fenzi - 1.3.6-9 +- Drop /var/run as it's not used anymore - bug #656684 + +* Wed Oct 06 2010 Kevin Fenzi - 1.3.6-8 +- Add patch to make rkhunter use unhide if installed - bug #636396 + +* Sat Jun 05 2010 Kevin Fenzi - 1.3.6-7 +- Add ipsec.hmac exclude - bug #560594 + +* Fri May 28 2010 Kevin Fenzi - 1.3.6-6 +- Add exclude for md-device-map - bug #596731 +- Supress ssh version check - bug #596775 + +* Sat Mar 06 2010 Kevin Fenzi - 1.3.6-5 +- Change config to not specify XINETD_PATH - bug #560562 + +* Sat Jan 23 2010 Kevin Fenzi - 1.3.6-4 +- Change email to just root instead of root@localhost - bug #553179 +- Add .k5login.5.gz to files whitelist - bug #553134 + +* Tue Jan 05 2010 Kevin Fenzi - 1.3.6-3 +- Add some more ssh hmac files to whitelist - bug #552621 +- Re-add /dev/.mdadm.map to whitelisted files - bug #539405 + +* Tue Dec 01 2009 Kevin Fenzi - 1.3.6-2 +- Disable apps check by default - bug #543065 + +* Sun Nov 29 2009 Kevin Fenzi - 1.3.6-1 +- Update to 1.3.6 + +* Thu Nov 26 2009 Kevin Fenzi - 1.3.4-9 +- Add exception for /dev/.mdadm file - bug #539405 + +* Sun Jul 26 2009 Fedora Release Engineering - 1.3.4-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Fri Jul 03 2009 Kevin Fenzi - 1.3.4-7 +- Add exception for software raid udev file - bug #509253 + +* Sat Jun 06 2009 Kevin Fenzi - 1.3.4-6 +- Add /usr/bin/.fipscheck.hmac to ok files - bug #494096 + +* Sun Mar 08 2009 Kevin Fenzi - 1.3.4-5 +- Fix typo in patch file + +* Wed Mar 04 2009 Kevin Fenzi - 1.3.4-4 +- Rework spec file +- Add check for the new hmac ssh files + +* Thu Feb 26 2009 Kevin Fenzi - 1.3.4-3 +- Update cron job to include hostname (thanks Manuel Wolfshant) + +* Wed Feb 25 2009 Fedora Release Engineering - 1.3.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Fri Jan 02 2009 Kevin Fenzi - 1.3.4-1 +- Update to 1.3.4 +- Use libdir as tmp dir - bug #456340 + +* Sat Dec 13 2008 Kevin Fenzi - 1.3.2-6 +- Fix cron job sending as attachment - bug #472679 +- Fix cron job trying to send with colors - bug #475916 + +* Wed Sep 03 2008 Kevin Fenzi - 1.3.2-5 +- Patch debug tmp file issue - bug #460628 + +* Mon Jun 16 2008 Kevin Fenzi - 1.3.2-4 +- Fix cron script to only mail on warn/error - bug #450703 +- Fix conditional to account for fc10 rsyslog + +* Mon Apr 28 2008 Kevin Fenzi - 1.3.2-3 +- Change cron to run after prelink - bug #438622 + +* Wed Mar 26 2008 Kevin Fenzi - 1.3.2-2 +- Move things to more standard locations for selinux - bug #438184 +- Add exception for pulseaudio file - bug #438622 + +* Thu Feb 28 2008 Kevin Fenzi - 1.3.2-1 +- Update to 1.3.2 +- Fix cron script + +* Thu Feb 28 2008 Kevin Fenzi - 1.3.0-2 +- Use /etc/redhat-release for EPEL and /etc/fedora release for Fedora. +- Add conditionals to support EPEL +- Fix man page warning. + +* Sun Feb 03 2008 Kevin Fenzi - 1.3.0-1 +- Revive package, clean up spec +- Update to 1.3.0 + +* Sat Mar 18 2006 Greg Houlette - 1.2.8-3 +- Made an RPM transparent change to move the sha1 canary check + file out of CVS and into the external lookaside cache (whose + filename changes with every new package release anyway...) + +* Fri Mar 17 2006 Greg Houlette - 1.2.8-2 +- Fixed architectural dependency during package creation eliminating + use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting) + +* Tue Mar 7 2006 Greg Houlette - 1.2.8-1 +- New package version release +- reworked the .spec file to support optional dist tag +- Updated the application check default patchfile (chunk failure) +- Changed to SHA1 for optional message digest (canary check) +- Added a couple of suggested skip entries to rkhunter.conf + +* Sat Jun 11 2005 Greg Houlette - 1.2.7-1 +- Added signature auto-updating to CRON scan (new script) +- Removed BOOTSCAN pending rewrite to full SysV Init scan in background +- Added the --append-log command line option +- Added Date Stamping to output +- Fixed bug in /etc/group missing report +- New package version release + +* Sun Jan 2 2005 Greg Houlette - 0:1.1.9-1 +- New package version release +- Added the --run-application-check command line option + to listing in command help +- Replaced 'Here' Doc editing of rkhunter.conf file + with in-place Perl edit +- tweaked rpmbuild -bb Autoclean + +* Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited) +- Removed redundant buildrequires /bin/sh, coreutils and perl +- Revise postun scriptlet +- Added /usr/share/doc/rkhunter-1.1.8/ to files list + +* Mon Oct 11 2004 Greg Houlette - 0:1.1.8-0.fdr.1 +- Changed Release Tag to 0.fdr.1 (testing) for QA +- Removed wget from dependencies +- Hid (temporarily) the --skip-application-check command + line option from being listed in help +- Fixed the spec files list, again! + +* Fri Oct 8 2004 Greg Houlette - 0:1.1.8-0.fdr.0.2.beta2 +- Unified and disabled the md5 canary check in prep + (check is now optional) removing the sha1 cross-check +- Fixed the spec files list, adding the /var/rkhunter + directory and the /usr/bin/rkhunter executable +- Fixed missing dependencies (rkh uses runtime checks) +- Disabled "auto-clean" for rpmbuild -bb +- Changed Application version scan default to + disabled awaiting backport fix in upstream sources +- Fixed shared_man_search.patch, configuration files + verify and added postun(install) cleanup + +* Fri Oct 1 2004 Greg Houlette - 0:1.1.8-0.fdr.0.1.beta1 +- More cosmetic patchwork +- Changed Release Tag to beta1 (pre-release) for QA submit + +* Tue Sep 28 2004 Greg Houlette - 0:1.1.8-0.fdr.1 +- Removed hidden_search.patch (1.1.7) after it was + merged into upstream source by Michael Boelen +- Removed .spec file from md5 and sha1 file checks + (it must be modifiable by Fedora QA release build) +- Added BOOTSCAN description file to documentation +- Restructured dynamic file creation ('Here' Docs) + moving them to the "prep" stage so that *_ALL_* + files are available prior to the "build" stage + (for inspection purposes) +- Added a /etc/sysconfig/rkhunter parameters file + +* Sun Aug 29 2004 Greg Houlette - 0:1.1.7-0.fdr.1 +- Cosmetic patchwork + +* Sat Aug 21 2004 Greg Houlette - 0:1.1.6-0.fdr.1 +- Moderate reworking of .spec file for packaging standards +- Added md5 and sha1 file checks to prep procedure for source .rpm +- Included an optional rc.local replacement for scan on boot (with full logging) + +* Tue Aug 10 2004 Michael Boelen - 1.1.5 +- Added update script +- Extended description + +* Sun Aug 08 2004 Greg Houlette - 1.1.5 +- Changed the install procedure eliminating the specification of + destination filenames (only needed if you are renaming during install) +- Changed the permissions for documentation files (root only overkill) +- Added the installation of the rkhunter Man Page +- Added the installation of the programs_{bad, good}.dat database files +- Added the installation of the LICENSE documentation file +- Added the chmod for root only to the /var/rkhunter/db directory + +* Sun May 23 2004 Craig Orsinger (cjo) +- version 1.1.0-1.cjo +- changed installation in accordance with new rootkit installation + procedure +- changed installation root to conform to LSB. Use standard macros. +- added recursive remove of old build root as prep for install phase + +* Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700 +- dropped Requires: perl - rkhunter works without it +- dropped the bash alignpatch (check the source or contact me) +- various file mode fixes (.../tmp/, *.db) +- optimized the %%files section - any new files in the + current dirs will be fine - just %%{__install} them. + +* Mon Apr 26 2004 Michael Boelen - 1.0.8-0 +- Fixed missing md5blacklist.dat + +* Mon Apr 19 2004 Doncho N. Gunchev - 1.0.6-1.mr700 +- added missing /usr/local/rkhunter/db/md5blacklist.dat +- patched to align results in --cronjob, I think rpm based + distros have symlink /bin/sh -> /bin/bash +- added --with/--without alignpatch for conditional builds + (in case previous patch breaks something) + +* Sat Apr 03 2004 Michael Boelen / Joe Klemmer - 1.0.6-0 +- Update to 1.0.6 + +* Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0 +- initial .spec file diff --git a/rkhunter.sysconfig b/rkhunter.sysconfig new file mode 100644 index 0000000..2dacc41 --- /dev/null +++ b/rkhunter.sysconfig @@ -0,0 +1,10 @@ +# System configuration file for Rootkit Hunter which +# stores RPM system specifics for cron run, etc. +# +# MAILTO= +# DIAG_SCAN= no - perform normal report scan +# yes - perform detailed report scan +# (includes application check) + +MAILTO=root@localhost +DIAG_SCAN=no diff --git a/sources b/sources index e69de29..956755f 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216