1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
### This file is used to configure the daily cron job for chkrootkit(1)
## It is sourced by chkrootkit-daily so needs to be a valid
## shell script.
##
## The majority of the options allow the output of chkrootkit to be
## filtered (changed) and/or ignored to hide false positives.
## Whether the daily cron job should run chkrootkit at all
# true/false, default: true
RUN_DAILY="true"
## Arguments to pass to chkrootkit (default: "").
# See chkrootkit(1) for details, but particularly useful are
# "-q" (especially useful if you set DIFF_MODE=false above )
# "-e" and "-s" (which are yet another way to hide output)
# The default is to pass no arguments so you see all output: this is
# particularly useful with DIFF_MODE=true as it gives context when the
# output changes, but DIFF_MODE hides the text that does not change
RUN_DAILY_OPTS=""
## Whether to show changes since last run (true/false, default: true)
# true means you will see how the entire differs (using diff(1)) to
# the 'expected' output in /var/log/chkrootkit/log.expected
# if that file does not exist you will see the whole output.
#
# If set to false you see the whole output every day - if you do set
# DIFF_MODE to "false" you probably also want RUN_DAILY_OPTS="-q"
#
DIFF_MODE="true"
### The results of chkrootkit are passed through $FILTER and $IGNORE_FILE
## FILTER is a way of changing output to make it stable or hide it
## completely (especially useful when DIFF_MODE=true
#
# FILTER can be any shell command which will be piped unfiltered output
# on stdin and anything written to stdout will become the new,
# filtered, output.
#
# The default uses sed to do two things
# 1) stops message (from ifpromisc, run by the 'sniffer' test) about
# 'usual' network managers changing if their pid, interface name,
# or order changes
# 2) stops list of processes not using utmp (from chkutmp) changing if
# their pid changes
# To disable both of these defaults you can set this to "" or "cat"
FILTER="sed -re 's![[:alnum:]]+: PACKET SNIFFER\(((/usr/lib/systemd/systemd-networkd|/usr/sbin/(dhclient|dhcpc?d[0-9]*|wpa_supplicant|NetworkManager))\[[0-9]+\](, )?)+\)!<interface>: PACKET SNIFFER\([systemd-networkd|dhclient|dhcpd|dhcpcd|wpa_supplicant|NetworkManager]{PID}\)!' -e 's/(! [[:alnum:]+-]+)\s+[0-9]+/\1 {PID}/'"
## If $IGNORE_FILE exists then lines of output matching patterns that
## appear in $IGNORE_FILE are removed from the output. Each line in
## $IGNORE_FILE interpreted as an extended regexp, see grep(1). If
## $IGNORE_FILE is empty (the default) or does not exist then no
## filtering is done.
#
# This is done after $FILTER - you can use either or both. IGNORE_FILE
# is slightly simpler but slightly less powerfull than FILTER as you
# can only hide, not change output.
#
# The default is /etc/chkrootkit/chkrootkit.ignore (which is empty by
# default, meaning nothing is ignored)
IGNORE_FILE="/etc/chkrootkit/chkrootkit.ignore"
## Email address to which output is sent.
# If empty, no email is sent by chkrootkit-daily: output is left on stdout
# (if running under cron stdout may be emailed)
MAILTO="root"
### The remaining options are commented out as the defaults are likely
### to be fine for most users, but you can edit these as well:
## Subject of email
# SUBJECT="[chkrootkit] alert for $(hostname --fqdn 2>/dev/null || hostname --short 2>/dev/null || echo "localhost")"
## The chkrootkit(1) scanner that is run
# what is actually run is: eval "$IONICE" "$CHKROOTKIT" "$RUN_DAILY_OPTS"
#CHKROOTKIT=/usr/sbin/chkrootkit
## Where output is saved
#LOG_DIR=/var/log/chkrootkit
## 'Clean' output (after FILTER and IGNORE_FILE)
#OUTPUT="$LOG_DIR/log.today"
## 'Raw' output is saved here
#RAW_OUTPUT="$OUTPUT.raw"
## 'Expected' output (only used if DIFF_MODE=true)
#EXPECTED_OUTPUT="$LOG_DIR/log.expected"
## The default is to run using ionice if possible.
## If you do not want to use ionice at all, set IONICE="" instead
#if [ -x /usr/bin/ionice ] && /usr/bin/ionice -c3 true 2>/dev/null; then
# IONICE="/usr/bin/ionice -c3"
#else
# IONICE=""
#fi
|
