FYI on chkrootkit 0.45
FYI on http://www.chkrootkit.org/ and chkrootkit version 0.45.
I have two separate bug reports into the author on this new version:
1. If you are running this software on RedHat Linux 7.3 and prior, the tests for lkm utilizing ps do not work.
2. False reports on bindshell appear to be common; we just had one today where it reported ports 114 and 145 were in use with a bindshell root kit; and it was actually part of the IP address rather than the port.
The author has a fix for #1 and is testing it; #2 was just reported this morning.
Thank you.
