From owner-freebsd-ports@FreeBSD.ORG Tue Jan 4 18:52:30 2011 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 307711065697 for ; Tue, 4 Jan 2011 18:52:30 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from asmtpout026.mac.com (asmtpout026.mac.com [17.148.16.101]) by mx1.freebsd.org (Postfix) with ESMTP id 180758FC1C for ; Tue, 4 Jan 2011 18:52:29 +0000 (UTC) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=us-ascii Received: from cswiger1.apple.com ([17.209.4.71]) by asmtp026.mac.com (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008; 64bit)) with ESMTPSA id <0LEI0045QHR16F20@asmtp026.mac.com> for freebsd-ports@freebsd.org; Tue, 04 Jan 2011 10:52:14 -0800 (PST) X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 suspectscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=6.0.2-1010190000 definitions=main-1101040070 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.2.15,1.0.148,0.0.0000 definitions=2011-01-04_10:2011-01-04, 2011-01-04, 1970-01-01 signatures=0 From: Chuck Swiger In-reply-to: Date: Tue, 04 Jan 2011 10:52:13 -0800 Message-id: <35113D20-59B2-4924-823B-DF5F97BE1F7A@mac.com> References: To: Torfinn Ingolfsen X-Mailer: Apple Mail (2.1082) Cc: FreeBSD Ports ML Subject: Re: security/rkhunter 1.3.8 - false warning? X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jan 2011 18:52:30 -0000 On Jan 4, 2011, at 9:38 AM, Torfinn Ingolfsen wrote: > rkhunter 1.3.8 from ports complains about the /etc/passwd file. Why does it do that? It's buggy? RKHunter is better known for generating vast numbers of obscure false positives than it is for actually providing a security benefit. Something like tripwire or a functioning backup system which can provide a comparison of changes against current filesystem state is much more likely to be useful. Regards, -- -Chuck