[ossec-list] ossec on lunar linux

[Martin West <martin@xxxxxxxxxxxxxxxx>]

Got this error ...

Received From: andromda->rootcheck
Rule: 14 fired (level 8) -> "Rootkit detection engine message"
Portion of the log(s):

Trojaned version of file '/bin/netstat' detected. Signature used: 'bash|
^/bin/sh|/dev/[^aik]|/prof|grep|addr\.h' (Trojan)

and chkrootkit also flagged it but we think it is invalid ...

"I put one of my top guys on this and his analysis is that the reason
lots of rootkit-packages trigger on our netstat is that its been built
with debugging-symbols and contains the string "sockaddr.h" which most 
rootkit-checkers isn't used to seeing.

        Cheers Leif"

Thanks for a great product.

Martin West