Re: [cobalt-security] cron and chkrootkit

["Jelmer Jellema" <lists@xxxxxxxxxxxxxxx>]

> # Monitor chkrootkit-0.37
> 00 7 * * * (cd /home/sites/home/users/admin/chkrootkit-0.37; ./chkrootkit
2>&1 | mail -s "chkrootkit output" root)

Change it to (cd /home/sites/home/users/admin/chkrootkit-0.37; ./chkrootkit
| mail -s "chkrootkit output" root 2>&1)

or just leave the | mail stuff behind, cron usualy mails any output anyway

Jelmer

Jelmer Jellema
Spin in het Web Hosting
http://hosting.spininhetweb.nl


>
> ----------
>
> [root admin]# pwd
> /home/sites/home/users/admin
> [root admin]# ls -al
> drwxr-xr-x   2 admin    admin        1024 Sep 24 10:23 chkrootkit-0.37
> [root admin]# cd chkrootkit-0.37/
> [root chkrootkit-0.37]# ls -al
> drwxr-xr-x   2 admin    admin        1024 Sep 24 10:23 .
> drwxrws--x  10 admin    admin        1024 Sep 24 10:44 ..
> -r--r--r--   1 admin    admin        1343 Sep 16 13:50 COPYRIGHT
> -r--r--r--   1 admin    admin        1318 Sep 16 10:28 Makefile
> -r--r--r--   1 admin    admin       13036 Sep 16 11:29 README
> -r--r--r--   1 admin    admin        1323 Sep 10 10:02 README.chklastlog
> -r--r--r--   1 admin    admin        1292 Sep 10 10:02 README.chkwtmp
> -rwxrwxr-x   1 admin    admin        3028 Sep 24 10:23 check_wtmpx
> -r--r--r--   1 admin    admin        7191 Sep 10 10:02 check_wtmpx.c
> -rwxrwxr-x   1 admin    admin        7256 Sep 24 10:23 chklastlog
> -r--r--r--   1 admin    admin        7746 Sep 10 10:02 chklastlog.c
> -rwxrwxr-x   1 admin    admin        6380 Sep 24 10:23 chkproc
> -r--r--r--   1 admin    admin        3624 Sep 16 10:12 chkproc.c
> -rwxr--r--   1 admin    admin       57144 Sep 24 10:23 chkrootkit
> -r--r--r--   1 admin    admin         528 Sep 16 09:46 chkrootkit.lsm
> -rwxrwxr-x   1 admin    admin        4368 Sep 24 10:23 chkwtmp
> -r--r--r--   1 admin    admin        1945 Sep 10 10:03 chkwtmp.c
> -rwxrwxr-x   1 admin    admin        4688 Sep 24 10:23 ifpromisc
> -r--r--r--   1 admin    admin        3358 Sep 10 10:03 ifpromisc.c
> -rwxrwxr-x   1 admin    admin      221328 Sep 24 10:23 strings
> -r--r--r--   1 admin    admin        2437 Sep 10 10:03 strings.c
>
> Can anyone shed any light on why this is not working?
>
> Thanks!
>
>
>
>
> _________________________________________________________________
> Send and receive Hotmail on your mobile device: http://mobile.msn.com
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>