Re: rootkit not found by rkhunter

[Mark van Walraven <markv@netvalue.net.nz>]

> AFAIK, the best way to know if you're running a stale kernel is to
> compare the uptime of the machine against the mtime of the actual kernel
> (using, e.g. "stat /boot/vmlinuz-2.6.26-2-686").  If the uptime of the
> machine places the last reboot sometime before the kernel was updated,
> you're not up to date.  If there's a better way to test this, I'd love
> to know about it.

Comparing the outputs of:

	sed -n 's/[^(]*(Debian \([^)]*\)).*/\1/p' /proc/version

and:

	dpkg -s $(dpkg -S $(readlink /vmlinuz) | cut -d: -f1) |
		awk '/^Version: / {print $2}'

has worked well for me - thanks to the kernel team for including the
version and revision!

Mark.