[Fwd: Re: ssh checksum error]

[bill at horne.net (Bill Horne)]

> "Patrick R. McManus" wrote:
> 
> > [Derek D. Martin: Tue, Apr 30, 2002 at 11:55:25PM -0400]
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > >
> > > Off list, someone asked me:
> > > > Two questions:
> > > >
> > > > 1. Are there security tools that will tell if my machine has been
> > > > owned?
> > >
> > > Yes, but they generally require that you use them BEFORE there's any
> > > possibility of your system being compromised (i.e. before it's been
> >
> > I've found chkrootkit (http://www.chkrootkit.org/) helpful after the
> > fact. Negative reports (not cracked) are, of course, not to be
> > trusted in any install-after-the-fact pacakges, but I like how it will
> > give a quick positive to confirm any suspicions for most common cases.
> >
> > -P
> >

Bill Horne said:

> I just ran it: it looks OK, accept for a warning about a "suspicious" file
> in the perl5 directory chain: ".packlist"
> 
> I've copied the file to my html directory: please examine it and tell me
> what looks suspicious. TIA.
> 
> http://billhorne.homelinux.org/packlist
> 
> Bill

Some more info:

The actual report was as follows:

/usr/lib/perl5/5.6.0/i386-linux/.packlist (space in original)
(same line)
/usr/lib/perl5/site_perl/5.6.0/i386-linux/Digest/MD5/.packlist

So, it may be complaining that the "MD5" directory wasn't found, since
it doesn't appear under the "Digest" directory. Anyone know if this is a
RedHat specific exception? Other opinions?

TIA.

Bill