Re: Should I install chkrootkit?
On Fri 06 Jun 2014 at 13:35:38 +0200, Filip wrote:
> Do you have systemd-sysv installed ? When that package is installed
> /sbin/init is a symlink to systemd and I have heard that chkrootkit
> gives false positives for the suckit rootkit with that.
chkrootkit gives false positives as a matter of course. There is no well
documented description of it ever discovering anything malign.
> You could double-check with rkhunter.
This person did:
suckit apparently enters through /dev/kmem.
brian@desktop:~$ ls -l /dev/kmem
ls: cannot access /dev/kmem: No such file or directory