1 Summary: chkrootkit - locally checks for signs of a rootkit
2 Summary(pl): chkrootkit - narzêdzie do lokalnego szukania oznak rootkitów
7 Group: Applications/Networking
8 Source0: ftp://sunsite.icm.edu.pl/pub/unix/security/chkrootkit/%{name}-%{version}.tar.gz
10 Source2: %{name}.sysconfig
11 Patch0: %{name}-CC.patch
12 Patch1: %{name}-nostrip.patch
13 Patch2: %{name}-names.patch
14 Patch3: %{name}-wtmp.patch
15 URL: http://www.chkrootkit.org/
16 BuildRequires: glibc-static
17 BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
21 Chkrootkit is a toolkit to locally check for signs of a rootkit.
22 - chkrootkit: a shell script that checks system binaries for rootkit
23 modification. (If you can't trust rpm -Va)
24 - ifpromisc: checks if the network interface is in promiscuous mode.
25 (If you can't trust netstat)
26 - chklastlog: checks for lastlog deletions.
27 - chkwtmp: checks for wtmp deletions.
28 - check_wtmpx: checks for wtmpx deletions. (Solaris only)
29 - chkproc: checks for signs of LKM trojans. (kernel modules)
30 - strings: quick and dirty strings replacement.
33 Chkrootkit to zestaw narzêdzi do lokalnego sprawdzania oznak u¿ycia
35 - chkrootkit: skrypt pow³oki sprawdzaj±cy binarne pliki systemowe na
36 obecno¶æ modyfikacji typowych dla rootkitów (je¶li nie mo¿na zaufaæ
38 - ifpromisc: sprawdza czy interfejs sieciowy jest w trybie promiscuous
39 (gdy nie mo¿na zaufaæ netstat)
40 - chklastlog: sprawdza czy logi nie by³y kasowane
41 - chkwtmp: sprawdza kasowanie wtmpx
42 - check_wtmpx: sprawdza kasowanie w wtmpx deletions (tylko Solaris)
43 - chkproc: szuka oznak trojanów LKM (modu³y j±dra)
44 - strings: szybko i brzydko napisany zamiennik programu strings.
47 %setup -q -n %{name}-pre-%{version}
59 rm -rf $RPM_BUILD_ROOT
60 install -d $RPM_BUILD_ROOT{%{_bindir},/etc/{sysconfig,cron.weekly}}
62 for x in check_wtmpx chklastlog chkproc chkwtmp ifpromisc strings; do
63 install $x $RPM_BUILD_ROOT/%{_bindir}/%{name}-$x
66 install chkrootkit $RPM_BUILD_ROOT/%{_bindir}
68 install %{SOURCE1} $RPM_BUILD_ROOT/etc/cron.weekly/
69 install %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/chkrootkit
72 rm -rf $RPM_BUILD_ROOT
75 %defattr(644,root,root,755)
76 %doc COPYRIGHT README README.chklastlog README.chkwtmp
77 %attr(755,root,root) %{_bindir}/*
78 %attr(750,root,root) /etc/cron.weekly/chkrootkit-check
79 %attr(640,root,root) %config(noreplace) %verify(not mtime size md5) /etc/sysconfig/chkrootkit