https://bugzilla.novell.com/show_bug.cgi?id=731281 https://bugzilla.novell.com/show_bug.cgi?id=731281#c2 Jim Henderson changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hendersj@gmail.com --- Comment #2 from Jim Henderson 2012-01-18 17:20:46 UTC --- I've got a couple 12.1 x86_64 systems here (and an x86 system) - we had a question about this in the forums so I checked my systems, and I didn't get this warning using chkrootkit. The strings command does show results, so I wonder if something's changed in chkrootkit to relax this now? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=731281 https://bugzilla.novell.com/show_bug.cgi?id=731281#c4 --- Comment #4 from Jim Henderson 2012-01-18 21:21:45 UTC --- Interesting. I wonder: If you run "rpm -Vv systemd" what result do you get? Also, where did you obtain chkrootkit from? I installed from the OSS repo for 12.1. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=731281 https://bugzilla.novell.com/show_bug.cgi?id=731281#c6 --- Comment #6 from Ursan Marius Bogdan 2012-01-19 07:26:51 UTC --- I got chkrootkit from openSUSE official repos and then i got it from openSUSE Tumbleweed repo. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=731281 https://bugzilla.novell.com/show_bug.cgi?id=731281#c7 Ursan Marius Bogdan changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Security |Security Product|openSUSE 12.1 |openSUSE 12.2 Summary|Chkrootkit gives a false |Chkrootkit gives a false |positive about /sbin/init |positive about cron under |and wted |openSUSE 12.2 OS/Version|openSUSE 12.1 |openSUSE 12.2 --- Comment #7 from Ursan Marius Bogdan 2012-10-14 18:29:42 UTC --- Good evening, it seems that now rkhunter has another thing with cron: [20:51:54] Info: Starting test name 'running_procs' [20:51:57] Checking running processes for suspicious files [ Warning ] [20:51:57] Warning: The following processes are using suspicious files: [20:51:57] Command: cron [20:51:57] UID: 0 PID: 2250 [20:51:57] Pathname: /etc/crontab [20:51:57] Possible Rootkit: Unknown rootkit Using ps -aux i found process 2250: root 2250 0.0 0.0 4912 920 ? Ss 19:22 0:00 /usr/sbin/cron -n -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.