./security/chkrootkit, Locally checks for signs of a rootkit

[ Image CVSweb ] [ Image Homepage ] [ Image RSS ] [ Image Required by ]

Branch: CURRENT, Version: 0.58b, Package name: chkrootkit-0.58b, Maintainer: pkgsrc-users

chkrootkit is a tool to locally check for signs of a rootkit. It
contains:

* chkrootkit: a shell script that checks system binaries for
rootkit modification.
* ifpromisc.c: checks if the network interface is in promiscuous
mode.
* chklastlog.c: checks for lastlog deletions.
* chkwtmp.c: checks for wtmp deletions.
* check_wtmpx.c: checks for wtmpx deletions. (Solaris only)
* chkproc.c: checks for signs of LKM trojans.
* chkdirs.c: checks for signs of LKM trojans.
* strings.c: quick and dirty strings replacement.


Required to build:
[pkgtools/cwrappers]

Master sites:

Filesize: 41.95 KB

Version history: (Expand)

CVS history: (Expand)


   2026-08-04 22:29:21 by Thomas Klausner | Files touched by this commit (336) 
Log message:
*: add LDFLAGS overide that was previously in mk

This is a workaround and should be fixed properly per-package - they
should use the pkgsrc LDFLAGS, but this restores what happened
before the mk/ cleanup.

Fixes relro build for packages that do not honor LDFLAGS.

Package list provided by mef@, thanks!

Workaround commit requested by bsiegert on tech-pkg.
   2025-11-28 08:27:42 by Thomas Klausner | Files touched by this commit (1) 
Log message:
chkrootkit: switch to https
   2025-04-04 01:48:48 by Greg Troxel | Files touched by this commit (1) 
Log message:
security/chkrootkit: Drop MESSAGE as ancient

It is no longer useful to give a list of tested platforms from the era
of NetBSD 1.6, and that list from 2006 is surely inaccurate with
respect to a more recent release.
   2023-10-17 21:24:04 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (5) 
Log message:
chkrootkit: Update to 0.58b

pkgsrc changes:
---------------
  * Update to latest release.
  * Update MASTER_SITES.

upstream changes:
-----------------
10/13/2016 - Version 0.51 Mumblehard backdoor/botnet detection
  Linux.Xor.DDoS Malware
  Malicious TinyDNS detection
  Backdoors.Linux.Mokes.a detection
  Minor bug fixes

13/03/2017 - Version 0.52 Linux.Proxy.10 detection
  strings.c & chkutmp.c bug fixes

01/25/2019 - Version 0.53 Rocke Monero Miner detection
  Added ss support
  ifconfig.c bug fixes
  Minor bug fixes

12/24/2020 - Version 0.54 PWNLNX4 and 6 Rootkits detection
  BTRFS bug fix
  Fedora bug fix
  Bug fix release

06/10/2021 - Version 0.55 Umbreon Linux Rootkit detection
  Kinsing.A Backdoor
  RotaJakito Backdoor
  Minor bug fixes

12/22/2022 - Version 0.56 Kovid rootkit
  Syslogk rootkit
  Minor bug fixes

01/13/2023 - Version 0.57 bug fix release

06/29/2023 - Version 0.58
  New option to avoid scanning network filesystems (-T)
  Linux BPFDoor Malware
  Minor buf fixes
   2023-10-16 22:55:52 by =?UTF-8?B?RnLDqWTDqXJpYyBGYXViZXJ0ZWF1?= | Files touched by this commit (6) 
Log message:
chkrootkit: Fix build on Darwin
   2021-10-26 13:18:07 by Nia Alarie | Files touched by this commit (605) 
Log message:
security: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Unfetchable distfiles (fetched conditionally?):
./security/cyrus-sasl/distinfo \ 
cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
   2021-10-07 16:54:50 by Nia Alarie | Files touched by this commit (606) 
Log message:
security: Remove SHA1 hashes for distfiles
   2018-07-04 15:40:45 by Jonathan Perkin | Files touched by this commit (423) 
Log message:
*: Move SUBST_STAGE from post-patch to pre-configure

Performing substitutions during post-patch breaks tools such as mkpatches,
making it very difficult to regenerate correct patches after making changes,
and often leading to substituted string replacements being committed.