From owner-FreeBSD-users-jp@jp.FreeBSD.org Wed Apr 14 14:21:32 2004
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) id i3E5LWO73869;
	Wed, 14 Apr 2004 14:21:32 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from ybbsmtp04.mail.yahoo.co.jp (ybbsmtp04.mail.yahoo.co.jp [210.81.151.172])
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) with SMTP/inet id i3E5LV973864
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Wed, 14 Apr 2004 14:21:31 +0900 (JST)
	(envelope-from ked_kuri@ybb.ne.jp)
Received: from unknown (HELO ybb.ne.jp) (219.3.118.14 with poptime)
  by ybbsmtp04.mail.yahoo.co.jp with SMTP; 14 Apr 2004 05:21:28 -0000
X-Apparently-From: <ked_kuri@ybb.ne.jp>
From: Koshiro Kurihara <ked_kuri@ybb.ne.jp>
To: FreeBSD-users-jp@jp.FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
X-Mailer: TuruKame 3.06 (WinNT,500)
Organization: K.E.D.
In-Reply-To: <20040413180354.9FF2.ENDO_T@nifty.com>
References: <20040413180354.9FF2.ENDO_T@nifty.com>
Message-Id: <71C421E050AD0Aked_kuri@ybb.ne.jp>
Reply-To: FreeBSD-users-jp@jp.FreeBSD.org
Precedence: list
Date: Wed, 14 Apr 2004 14:21:18 +0900
X-Sequence: FreeBSD-users-jp 78926
Subject: [FreeBSD-users-jp 78926] Re: chkrootkit
Sender: owner-FreeBSD-users-jp@jp.FreeBSD.org
X-Originator: ked_kuri@ybb.ne.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+040413

$B7*86$G$9!#(B
$B7*86$G$9!#(B

chkrootkit $B$NK\2H(B
http://www.chkrootkit.org/
$B$N(B FAQ $B$K(B
------
6.How accurate is chkproc?
If you run chkproc on a server that runs lots of short time
processes it could report some false positives. chkproc compares
the ps output with the /proc contents. If processes are
created/killed during this operation chkproc could point out
these PIDs as suspicious.
------
$B$H$"$C$F<B9T;~4V$NC;$$%W%m%;%9$O$4G'<1$5$l$k;v$,$"$j$^$9!#(B
$B;d$N>l9g!"C;$$<B9T;~4V$N%W%m%;%9$r7+$jJV$75/F0$9$k%9%/%j%W%H$,(B
$B$"$C$F8+;v$K0z$C$+$+$j$^$7$?!#(B
chkrootkit $B$N%=!<%9$r8+$k$HJ,$k$N$G$9$,!"(B/proc $B0J2<$rD4$Y$k<j=g(B
$B$GA4%W%m%;%9$r%F!<%V%k2=$7$F$+$iL7=b$,L5$$$+D4$Y$k$F$*$j!"%F!<%V(B
$B%k2=$7$F$+$i8!::$9$k4V$K>C$($?%W%m%;%9$,$"$k$H%(%i!<$H$J$j$^$9!#(B

# $B:G=i$O;d$b%S%S%j$^$7$?(B
# $BF|K\(BMySQL$B%f!<%6!<2q(B $B%5%$%H$N7o$O%S%C%/%j$7$^$7$?$,!"BP4_$N2P;v(B
# $B$H$OJRIU$1$i$l$^$;$s!#(B
# $B$J$*!"(Bchkrootkit $B$H$$$($I$b40`z$G$O$"$j$^$;$s$N$G$4Cm0U$r(B
