chkrootkit on HP-UX 11 vs alternatives

[Tony Tibbenham]

All,

Chkrootkit (www.chkrootkit.org) is a great tool on it's native platforms (Linux and BSD) but has been reported in this forum to show false positives under HP-UX 11.

I shall work with the maintainers of chkrootkit to improve performance on HP-UX because chkrootkit is so quick to run and the results easy to understand.

Are there similar tools that work better with HP-UX?

Are there better trojan prevention and detection tools available in HP_UX? HP's IDS looks comprehensive but over complex

[dirk dierickx]

there is no rootkit checker i know of that works on hpux.
for IDS, i believe the regulars are available, tripwire/aide.

[Tony Tibbenham]

Chkrootkit 0.44 has been released. It still reports a false INFECTION on ifconfig having failed to find ifconfig in /sbin but is otherwise pretty good for a quick check of your system.

This patch removes the false 'infected' flag by looking for ifconfig rather than expecting it in /sbin
# diff chkrootkit.20040902 chkrootkit
2116c2116
< CMD="${ROOTDIR}sbin/ifconfig"
---
> CMD=`loc ifconfig ifconfig $pth`
#