![为什么 rkhunter 跳过空的和丢失的日志文件扫描?](https://linux22.com/image/870083/%E4%B8%BA%E4%BB%80%E4%B9%88%20rkhunter%20%E8%B7%B3%E8%BF%87%E7%A9%BA%E7%9A%84%E5%92%8C%E4%B8%A2%E5%A4%B1%E7%9A%84%E6%97%A5%E5%BF%97%E6%96%87%E4%BB%B6%E6%89%AB%E6%8F%8F%EF%BC%9F.png)
我注意到,当我使用以下方法扫描我的机器时:
sudo rkhunter --checkall --sk
日志文件中的该部分输出是:
[21:50:51] Checking for missing log files [ Skipped ]
[21:50:51] Checking for empty log files [ Skipped ]
[21:50:51]
[21:50:51] Info: Test 'apps' disabled at users request.
为什么有些测试被跳过了?我该如何让它不跳过它们?另外,这是什么意思Test 'apps' disabled at users request
,因为我没有要求它不测试任何东西?
操作系统信息:
Description: Ubuntu 14.10
Release: 14.10
封装信息:
rkhunter:
Installed: 1.4.0-3
Candidate: 1.4.0-3
Version table:
*** 1.4.0-3 0
500 http://gb.archive.ubuntu.com/ubuntu/ utopic/universe amd64 Packages
100 /var/lib/dpkg/status
答案1
首先,根据手册页 --checkall
不是有效命令。可能rkhunter
将其解释为--check
。
检查丢失和空的日志文件由文件系统测试。两者都是用户定义的检查;您必须告诉rkhunter
它应该检查哪些日志文件。这是相关部分/etc/rkhunter.conf
:
# The two options below may be used to check if a file is missing or empty
# (that is, it has a size of zero). The EMPTY_LOGFILES option will also check
# if the file is missing, since that can be interpreted as a file of no size.
# However, the file will only be reported as missing if the MISSING_LOGFILES
# option hasn't already done this.
#
# Both options are space-separated lists of pathnames, and may be specified
# more than once.
#
# NOTE: Log files are usually 'rotated' by some mechanism. At that time it is
# perfectly possible for the file to be either missing or empty. As such these
# options may produce false-positive warnings when log files are rotated.
#
# For both options the default value is the null string.
#
#EMPTY_LOGFILES=""
#MISSING_LOGFILES=""
我想它是不言自明的。
关于Test 'apps' disabled at users request
信息消息,答案也在 中/etc/rkhunter.conf
。您应该在这里查看:
# These two options determine which tests are to be performed. The ENABLE_TESTS
# option can use the word 'ALL' to refer to all of the available tests. The
# DISABLE_TESTS option can use the word 'NONE' to mean that no tests are
# disabled. The list of disabled tests is applied to the list of enabled tests.
#
# Both options are space-separated lists of test names, and both options may
# be specified more than once. The currently available test names can be seen
# by using the command 'rkhunter --list tests'.
#
# The supplied configuration file has some tests already disabled, and these
# are tests that will be used only occasionally, can be considered 'advanced'
# or that are prone to produce more than the average number of false-positives.
#
# Please read the README file for more details about enabling and disabling
# tests, the test names, and how rkhunter behaves when these options are used.
#
# The default values are to enable all tests and to disable none. However, if
# either of the options below are specified, then they will override the
# program defaults.
#
# hidden_procs test requires the unhide and/or unhide.rb commands which are
# part of the unhide respectively unhide.rb packages in Debian.
#
# apps test is disabled by default as it triggers warnings about outdated
# applications (and warns about possible security risk: we better trust
# the Debian Security Team).
#
ENABLE_TESTS=ALL
DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps
如果您确实想运行所有测试,可以从DISABLE_TESTS
要运行的测试名称中删除或将其全部替换为。或者,您可以使用以下命令运行所有测试:NONE
rkhunter
sudo rkhunter --sk --enable all --disable none