Hacker News Reader

1. install rkhunter

2. update it: #rkhunter --update

3. generate checksums of important files: #rkhunter --propupd

*NOTE: when normal system s/w updates are installed, some of the files watched by rkhunter may change and thus generate false warnings. It also needs to be run again to update checksums after updates.

View on HN

What stops an attacker running rkhunter --proupd after he/she has installed backdoors in a few of your binaries ? I realise what rkhunter does (searches for common backdoors), but I can't see what advantage the proupd argument adds.

It is useful if accounts other than root have been compromised, like the web server's.

Reply on news.ycombinator.com