AtomiCorp: Security for Everyone

Security Update

psa-proftpd 1.3.4a

Monday, 14 November 2011 11:20

This update has been duplicated in both the Atomic and ASL repositories.

Changelog

1.3.4a
---------

+ Fixed mod_load/mod_wrap2 build issues.

1.3.4
---------

+ New "NoEmptyFragments" TLSOption added; see the TLSOptions documentation
for details.
+ Improved configure script for cross-compiling.
+ Reworked the proftpd.spe

1.3.4a
---------

+ Fixed mod_load/mod_wrap2 build issues.

1.3.4
---------

+ New "NoEmptyFragments" TLSOption added; see the TLSOptions documentation
for details.
+ Improved configure script for cross-compiling.
+ Reworked the proftpd.spec RPM file
+ Fixed mod_sql_mysql "Alarm clock" bug on FreeBSD.
+ New "IgnoreSFTPSetTimes" SFTPOption added; see the SFTPOptions
documentation for details.
+ Fixed response pool use-after-free issue.

1.3.4rc3
---------

+ The mod_ldap configuration directives have changed to a simplified
version; please read the "Changes" section in README.LDAP for details.

+ Support for using RADIUS for authentication SSH2 logins, and for
supporting the NAS-IPv6-Address RADIUS attribute.

+ Automatically disable sendfile support on AIX systems.

+ <Limit WRITE> now prevents renaming/moving a file out of the limited
directory.

+ ExtendedLog entries now written for data transfers which time out.

1.3.4rc2
---------

+ Display messages work properly again.

(i.e. mod_tls). See http://bugs.proftpd.org/show_bug.cgi?id=3624 for

http://bugs.proftpd.org/show_bug.cgi?id=3586 for details.

+ Performance improvements, especially during server startup/restarts.

+ New --enable-memcache configure option

ProFTPD now provides an API for modules for using memcached servers for
caching information among different proftpd server and/or across
sessions. For more information, see the mod_memcache documentation
in doc/modules/mod_memcache.html.

+ New --enable-pcre configure option

The C library support for POSIX regular expressions is vulnerable to
some pathological regex patterns; the glibc library in particular
can be made to burn CPU with such patterns. Sites which wish to avoid
such buggy C library implementations can instead use PCRE for regular
expression support in ProFTPD, by using the --enable-pcre configure
option.

+ New modules

mod_tls_memcache

The mod_tls_memcache module uses the new mod_memcache/memcached support
in ProFTPD to use memcached servers for caching SSL session information.
This can be useful, especially when clusters of proftpd servers are
in used, or for preserving SSL session caches across proftpd restarts.
See doc/contrib/mod_tls_memcache.html for more details on this module.

+ New configuration directives:

MaxCommandRate

Some clients send FTP commands too quickly. The new MaxCommandRate
directive is used to detect and to throttle such malicious clients;
it also generates an event that can be used by the mod_ban module
for banning these clients. See doc/modules/mod_core.html#MaxCommandRate.

ProcessTitles

By default, proftpd changes the process title for session processes
to include the authenticated user name and the FTP command being
handled, including the paths to files being downloaded. The new
ProcessTitles directive can be used to modify proftpd's behavior with
regard to this session process title changing. See
doc/modules/mod_core.html#ProcessTitles for more info.

SQLNamedConnectInfo

Some sites wish to have mod_sql connections to multiple different
databases simultaneously, e.g. one connection for retrieving user
data and a separate connection for logging. To support such sites,
the new SQLNamedConnectInfo directive can be used to create "named
connection". These "named connections" can then be used in a
SQLNamedQuery, i.e. you can specify the named connection that a
SQLNamedQuery is to use when it is expected. More information can
found at doc/contrib/mod_sql.html#SQLNamedConnectInfo.

TraceOptions

The TraceLog can provide very detailed information, especially when
diagnosing an issue. To aid in such diagnoses, the new TraceOptions
directive can be used to add more information to the TraceLog,
such as client/server IP addresses (if available), and timestamps
with millisecond granularity. The documentation at
doc/modules/mod_core.html#TraceOptions has the details.

+ The following utilities are now installed under $prefix/bin/ by the
'make install' target: ftpasswd, ftpmail, ftpquota

+ Changed configuration directives:

BanOnEvent

The mod_ban module's BanOnEvent directive now supports a few more
events, namely 'MaxCommandRate' and 'UnhandledCommand'. These events
can be used to ban clients which send commands too quickly, or which
send too many unhandled/unknown commands.

ExtendedLog

For some LogFormat variables (e.g. %E, %I, %O) it is useful to log
them when then session exits. The mod_sql module has had the ability
to log at session exit for quite some time. The ExtendedLog directive
can how log at session exit as well, using the new "EXIT" command class.

LogFormat

The LogFormat directive now supports a couple of new variables:

%E variable, for end-of-session reason
%H variable, for IP address of server handling session

These are listed in the LogFormat docs; see
doc/modules/mod_log.html#LogFormat.

PathAllowFilter, PathDenyFilter

The PathAllowFilter and PathDenyFilter directives now support an
optional flags parameter, which can be used to specify e.g.
case-insensitive evaluation of the configured regular expression.
For example:

PathDenyFilter .jpg$ [NC]

See doc/modules/mod_core.html#PathAllowFilter for more details.

SFTPOptions

The mod_sftp module's SFTPOptions directive supports a new
'IgnoreSFTPSetPerms' option. This option is similar to the existing
'IgnoreSFTPUploadPerms'; it causes mod_sftp to silently ignore the SFTP
client's attempts to change file permissions. See
doc/contrib/mod_sftp.html#SFTPOptions.

SFTPPAMOptions

The SFTPPAMOptions directive for the mod_sftp_pam module now supports
a 'NoInfoMsgs' option, which disables the sending of informational
messages from the PAM library to the connecting SSH client. This
option can be used to make mod_sftp_pam behavior like OpenSSH with
regard to PAM support.

SQLNamedQuery

The SQLNamedQuery directive now supports an optional "named connection"
name, for supporting multiple database connections. See the
doc/contrib/mod_sql.html#SQLNamedConnectInfo docs for more information.

TLSSessionCache

The TLSSessionCache directive from the mod_tls module can now be
used to explicitly configure the session cache timeout when OpenSSL's
internal session caching mechanism (used by default) is being used.
See doc/contrib/mod_tls.html#TLSSessionCache for details.

Trace

The Trace directive can now to be used to specify a range of trace
channel log levels, rather than simply specifying the maximum log
level for a channel. For example, to see only messages from log
levels 5 to 8, you would do:

Trace DEFAULT:5-8

This is documented in the Trace directive documentation, at
doc/modules/mod_core.html#Trace.

+ New documentation:

doc/howto/ConnectionACLs.html

doc/utils/ftpasswd.html
doc/utils/ftpcount.html
doc/utils/ftpdctl.html
doc/utils/ftpquota.html
doc/utils/ftpscrub.html
doc/utils/ftptop.html
doc/utils/ftpwho.html

+ Developer/API Changes

The following functions have been removed, as they are not used anywhere
and should not be being used:

pr_response_send_ml()
pr_response_send_ml_start()
pr_response_send_ml_end()

The following function has been renamed/moved:

end_login() is now pr_session_end()

A related new function, pr_session_disconnect() is added. This new
function allows the caller to specify a reason code indicating why
the session is ending, as well as support for an optional string
for more details about the reason for ending the session.

1.3.4rc1
---------

+ Fixed Telnet IAC stack overflow vulnerability (ZDI-CAN-925)
+ Fixed directory traversal bug in mod_site_misc (CVE-2010-3867)
+ Fixed sql_prepare_where() buffer overflow (Bug#3536)
+ Added Japanese translation
+ Many mod_sftp bugfixes
+ Fixed SSL_shutdown() errors caused by OpenSSL 0.9.8m and later
+ Fixed handling of utmp/utmpx format changes on FreeBSD
+ Automatic detection of MySQL, Postgres library and header file locations
+ Added support for SMTP authentication in ftpmail script
+ Updated fnmatch implementation, using glibc-2.9 version.
+ Overhauled mod_ldap configuration directives, making mod_ldap easier
to configure. Previous configurations must be updated. See README.LDAP
for details.

+ New modules:

mod_copy

This module provides the SITE CPFR and SITE CPTO commands, for
allowing a client to copy files from one location to another on the
server, without requiring downloads/uploads. See
doc/contrib/mod_copy.html for details.

mod_deflate

This module provides support for MODE Z, which uses compression to
reduce the number of bytes required for data transfers and directory
lists. See doc/contrib/mod_deflate.html for more information.

Depending on the data being transferred, clients can see quite
a difference in the speed; see:

http://www.smartftp.com/support/kb/file.php?f=192

for some performance numbers.

mod_ifversion

This module allows for version-specific configuration sections of
the proftpd config file. It is useful for using the same proftpd
config across multiple servers where different proftpd versions may
be in use. See doc/contrib/mod_ifversion.html for examples.

mod_qos

This module allows administrators to set networking-specific
"Quality of Service" (QoS) bits on the packets used by the server.
More information can be found in doc/contrib/mod_qos.html

+ New configuration directives:

Protocols

This directive can be used to specify which protocols can be used
by a connecting client. It is designed to work with mod_ifsession,
so that it can be set on a per-user/group/class basis. See
doc/modules/mod_core.html#Protocols for details.

ScoreboardMutex

This directive is used to explicitly configure the patch to a
"mutex" file used for scoreboard locking; this file is used to
increase proftpd's performance under load. See:

http://bugs.proftpd.org/show_bug.cgi?id=3208

for more information.

SFTPClientAlive

This directive is used to enable a protocol-level "keep alive"
check for mod_sftp SSH connections. More details can be found
in doc/contrib/mod_sftp.html#SFTPClientAlive.

WrapOptions

The mod_wrap2 module has additional behaviors such as checking the
allow/deny rules at client connect time (versus after login),
and checking the allow/deny rules using all of a client's DNS names.
The WrapOptions directive is used to configure these behaviors;
see doc/contrib/mod_wrap2.html#WrapOptions for more information.

+ Changed configuration directives:

BanOnEvent

The BanOnEvent directive of the mod_ban module now supports
LoginRate events; see doc/contrib/mod_ban.html#BanOnEvent. This
lets mod_ban reject clients which are logging in too quickly.

ListOptions

The mod_ls module now supports the -c and -u options for the LIST
command. The ListOptions directive handles these options as well.
See the ls(1) man page for more details on these options.

In addition, the NoErrorIfAbsent ListOption can be used to configure
whether mod_ls returns a 226 response code, rather than the default
450 response code, for a LIST/NLST command for a path which does not
exist. Some clients are sensitive to this use case.

LogFormat

The LogFormat directive now supports two additional variables:
%I for logging the total number of bytes read from the network,
and %O for logging the total number of bytes written to the network.
Note that these values do NOT include any bytes for the TCP packet
overhead. The mod_sql module's SQLLog directive also supports these
variables.

These variables can be used to get a better idea of network traffic
per session/client, as well as for comparing the relative network
traffic of e.g. FTPS versus SFTP.

SFTPOptions

The mod_sftp module did not interoperate well with old ssh.com or
with Tectia SSH clients. Support for these clients was added to
mod_sftp via the OldProtocolCompat SFTPOption (Bug#3480). See
doc/contrib/mod_sftp.html#SFTPOptions for more information.

TLSOptions

When verifying a client's certificate, the mod_tls module could
be configured to check the iPAddress and/or dNSName portions of the
SubjectAltName section of the client certificate, via the TLSOptions
directive. A new CommonNamedRequired TLSOptions is now supported,
which tells mod_tls to check the CommonName (CN) section of the
client certificate. See doc/contrib/mod_tls.html#TLSOptions for
details.

UseSendfile

The UseSendfile directive can now be used in <Directory> sections and
.ftpaccess files. This means that sendfile(2) support can be disabled
on filesystems which do not support it, while still be used on other
parts of the filesystem which can support it.

The UseSendfile directive can now also configure how many bytes of
a file to send via sendfile(2) at a time; this can be either in number
of bytes, or in percentage of the file size. The advantage of this
is that now the ScoreboardFile (and ftptop/ftpwho) can show download
progress rates when UseSendfile is enabled.

See doc/howto/Sendfile.html for the full details.

+ Deprecated configuration directives:

DisplayGoAway

Support for this directive has been removed.
1.3.3g
---------

+ New "NoEmptyFragments" TLSOption added; see the TLSOptions documentation
for details.
+ Fixed mod_sql_mysql "Alarm clock" bug on FreeBSD.

1.3.3f
---------

+ Fixes segfault if mod_sql_mysql and "SQLAuthenticate groupsetfast"
configuration used.
+ Fixes mod_wrap syslog level (regression from Bug#3317).
+ Fixes mod_ifsession segfault if regular expression patterns used in
a <VirtualHost> section.

c RPM file
+ Fixed mod_sql_mysql "Alarm clock" bug on FreeBSD.
+ New "IgnoreSFTPSetTimes" SFTPOption added; see the SFTPOptions
documentation for details.
+ Fixed response pool use-after-free issue.

1.3.4rc3
---------

+ The mod_ldap configuration directives have changed to a simplified
version; please read the "Changes" section in README.LDAP for details.

+ Support for using RADIUS for authentication SSH2 logins, and for
supporting the NAS-IPv6-Address RADIUS attribute.

+ Automatically disable sendfile support on AIX systems.

+ <Limit WRITE> now prevents renaming/moving a file out of the limited
directory.

+ ExtendedLog entries now written for data transfers which time out.

1.3.4rc2
---------

+ Display messages work properly again.

(i.e. mod_tls). See http://bugs.proftpd.org/show_bug.cgi?id=3624 for

http://bugs.proftpd.org/show_bug.cgi?id=3586 for details.

+ Performance improvements, especially during server startup/restarts.

+ New --enable-memcache configure option

+ New --enable-pcre configure option

mod_tls_memcache

+ New configuration directives:

MaxCommandRate

ProcessTitles

SQLNamedConnectInfo

TraceOptions

+ The following utilities are now installed under $prefix/bin/ by the
'make install' target: ftpasswd, ftpmail, ftpquota

+ Changed configuration directives:

BanOnEvent

ExtendedLog

LogFormat

The LogFormat directive now supports a couple of new variables:

%E variable, for end-of-session reason
%H variable, for IP address of server handling session

These are listed in the LogFormat docs; see
doc/modules/mod_log.html#LogFormat.

PathAllowFilter, PathDenyFilter

PathDenyFilter .jpg$ [NC]

See doc/modules/mod_core.html#PathAllowFilter for more details.

SFTPOptions

SFTPPAMOptions

SQLNamedQuery

TLSSessionCache

Trace DEFAULT:5-8

This is documented in the Trace directive documentation, at
doc/modules/mod_core.html#Trace.

+ New documentation:

doc/howto/ConnectionACLs.html

doc/utils/ftpasswd.html
doc/utils/ftpcount.html
doc/utils/ftpdctl.html
doc/utils/ftpquota.html
doc/utils/ftpscrub.html
doc/utils/ftptop.html
doc/utils/ftpwho.html

+ Developer/API Changes

The following functions have been removed, as they are not used anywhere
and should not be being used:

pr_response_send_ml()
pr_response_send_ml_start()
pr_response_send_ml_end()

The following function has been renamed/moved:

end_login() is now pr_session_end()

1.3.4rc1
---------

+ New modules:

mod_copy

mod_deflate

This module provides support for MODE Z, which uses compression to
reduce the number of bytes required for data transfers and directory
lists. See doc/contrib/mod_deflate.html for more information.

Depending on the data being transferred, clients can see quite
a difference in the speed; see:

http://www.smartftp.com/support/kb/file.php?f=192

for some performance numbers.

mod_ifversion

mod_qos

This module allows administrators to set networking-specific
"Quality of Service" (QoS) bits on the packets used by the server.
More information can be found in doc/contrib/mod_qos.html

+ New configuration directives:

Protocols

ScoreboardMutex

This directive is used to explicitly configure the patch to a
"mutex" file used for scoreboard locking; this file is used to
increase proftpd's performance under load. See:

http://bugs.proftpd.org/show_bug.cgi?id=3208

for more information.

SFTPClientAlive

This directive is used to enable a protocol-level "keep alive"
check for mod_sftp SSH connections. More details can be found
in doc/contrib/mod_sftp.html#SFTPClientAlive.

WrapOptions

+ Changed configuration directives:

BanOnEvent

The BanOnEvent directive of the mod_ban module now supports
LoginRate events; see doc/contrib/mod_ban.html#BanOnEvent. This
lets mod_ban reject clients which are logging in too quickly.

ListOptions

The mod_ls module now supports the -c and -u options for the LIST
command. The ListOptions directive handles these options as well.
See the ls(1) man page for more details on these options.

LogFormat

These variables can be used to get a better idea of network traffic
per session/client, as well as for comparing the relative network
traffic of e.g. FTPS versus SFTP.

SFTPOptions

TLSOptions

UseSendfile

See doc/howto/Sendfile.html for the full details.

+ Deprecated configuration directives:

DisplayGoAway

Support for this directive has been removed.
1.3.3g
---------

+ New "NoEmptyFragments" TLSOption added; see the TLSOptions documentation
for details.
+ Fixed mod_sql_mysql "Alarm clock" bug on FreeBSD.

1.3.3f
---------

To Upgrade:

yum upgrade psa-proftpd

[asl-2.0] Clamav 0.97

Wednesday, 09 February 2011 16:20

Note: This package is duplicated in the Atomic channel.

Changelog

* libclamav/vba_extract.c: fix error path double free (bb#2486)
* libclamav/phishcheck.c: fix some missed safebrowsing URLs (bb #2514)
* libclamav/matcher-bm.c: fix error message (bb#2513)
* libclamav/matcher-hash.c: stop leaking virusnames (nopool mode)
* libclamav/disasm.c: sign extend immeds, displacers and reljumps (bb#2341)
* shared/optparser: when size limit is disabled set it to 4GB (bb#2471)
* shared/optparser.c: reduce BytecodeTimeout to 5s (instead of 60).
* libclamav/bytecode_vm.c: fix memset on bigendian arch (bb #2478).
* libclamav/pdf.c: fix missed detection (bb #2455).
* libclamav/pdf.c: fix another pdf uninit (bb #2404).
* libclamav/pdf.c: fix uninit value (bb #2455).
* libclamav/c++/llvm: port 2 upstream commits to fix bb#8723.
* unit_tests/check_bytecode.c: fix build on etch (bb #2399),
* build system: add AM macro CLAMDSCAN_LIBS (bb#2400)
* sigtool: handle .hs(b|u) and .ms(b|u) files
* sigtool: add new options --sha1 and --sha256
* freshclam: detect and fix corruptions of existing db files
* libclamav: merge multihash branch - we can now match on md5, sha1, sha256
* freshclam: verify integrity of all *.cvd files during each session
* libclamav/c++/ClamBCRTChecks.cpp: fix paranoid mode crash (bb #2434).
* sigtool: improve handling of spaces in cdiffs (bb#2090)
* libclamav/hashtab.c: properly clear the table
* freshclam/manager.c: fix version warning (bb#2456)
* libclamav: improve handling of HandlerType (bb#2298)
* libclamav/filetypes.c: improve detection of tar files
* libclamav/scanners.c: improve scanning of mail files in raw mode (bb#2244)
* clamscan: add new options --follow-(dir|file)-symlinks (bb#1870)
* libclamav/blob.c: properly scan files when LeaveTemporaryFiles is enabled (bb#2447)
* libclamav/disasm.c: fix movsx/movzx disasm src size (bb#2341)
* freshclam: fix again handling of relative db paths (bb#2240)
* clamav-milter: add LogClean option (bb#2442)
* clamd: bump default MaxConnectionQueueLength to 200
* shared/cdiff.c: Fix error path double free - missed in 4bc4581d
thanks Michael Tautschnig <mt*debian.org>
* clamav-milter/whitelist.c, clamscan/manager.c, libclamav/sis.c:
error path leaks and similar - thanks Michael Tautschnig <mt*debian.org>
* clamav-milter: handle EINTR during waitpid()
* freshclam, clamd: handle EINTR during waitpid() (bb#2422)
* libclamav/chmunpack.c: avoid crash on fstat failure (bb #2429).
* libclamav: pass array with initial matches to bytecode (bb#2397)
* libclamav/msexpand.c: fix name clash on HP-UX (bb#2398)
* libclamav/scanners.c: ScanMail wasn't always honored (bb#2426)
* clamd: don't report file hashes to clients (bb#2409)
* libclamav: preserve callbacks during db reload (bb#2418)
* libclamav/matcher-ac.c: optimize handling of multi-part signatures (bb#2322)
Patch by finglenark <finglenark*gmail.com>
* libclamav/vba_extract.c: fix error path double free (bb#2486)

To upgrade:

yum upgrade clamav

[asl-2.0] dazuko for 2.6.32.27

Tuesday, 21 December 2010 11:20

Changelog

Add support for 2.6.32.27 kernels

To upgrade

yum upgrade dazuko kmod-dazuko

yum upgrade dazuko kmod-dazuko-PAE

[asl-2.0] open-vm-tools for 2.6.32.27

Tuesday, 21 December 2010 11:17

Changelog

Add support for 2.6.32.27 kernels

To upgrade:

yum upgrade open-vm-tools

[asl-2.0] rkhunter 1.3.8-1

Wednesday, 17 November 2010 16:37

This package is duplicated in both the atomic and asl-2.0 repos.

New:
- It is now possible to whitelist specific rootkit strings in
specific files using the RTKT_FILE_WHITELIST option. Details
are in the configuration file.
- For those systems on which files generally have the immutable
-bit set, the 'immutable' test can now be reversed (that is,
warnings will be issued for files which do not have the bit
set). The configuration file option IMMUTABLE_SET can be set
to '1' to enable this. By default it is '0'.
- The installer now supports the ppc64 architecture.
- The RTKT_FILE_WHITELIST option can be used to whitelist
reported 'suspicious files' found in the 'running_procs' test.
- Using the EXISTWHITELIST configuration option it is now possible
to whitelist files and directories that might not always be
present on the system. Whitelisted items are, in effect,
whitelisted from 'existence' checks.
- Added a new test to check for hidden network ports being used.
It is called 'hidden_ports'. This test is disabled by default,
and will only run if the 'unhide-tcp' command is present.
- Added support for DragonFly BSD.
- Added Inqtana worm check (variants A, B and C).
- It is now possible to whitelist a combined pathname and port number
with the PORT_WHITELIST configuration option. Details are in the
configuration file.
- Added Togroot rootkit check.
- It is now possible to specify 'SOLARIS' as a package manager for
Solaris systems. It can be used to check several of the file
properties, such as the file permissions, ownership, size and so
on. By default the stored 16-bit hash value is not used, and a hash
value will be calculated, as before, using the configured hash
function. However, if it is wished that the stored hash value is
used, then the USE_SUNSUM configuration option must be enabled.
- The command-line option '--list perl' may be used to see the
installation status of perl modules that may be used by some of
the tests.
- For the file properties test the hash functions 'Whirlpool' and
'Ripemd160' may now be specified. However, only the relevant perl
module will be looked for when using these functions.
- Added Solaris Wanuk backdoor and worm checks.
- The new command-line option '-C' (or '--config-check') can be
used to check the rkhunter configuration files. This will check
most of the options, but only for the tests which would normally
be run (as defined by the enable and disable options). The program
exits once the check has run. See the man page for more details.
- The 'hidden_procs' test will now run the 'unhide.rb' command if it
is present. This is the Ruby version of the original C 'unhide'
program. (The 'unhide' command is also still run if found.)
- Added the DISABLE_UNHIDE configuration option. This allows users
to disable one or other of the 'unhide' or 'unhide.rb' commands
if they are both present on the system. The default is to look
for and run both commands.
- Added OS X Boonana (Koobface.A) trojan check.

Changes:
- Allow the 'unhide' command to be detected on Linux systems.
- Allow most of the whitelisting-type configuration options to
be specified more than once in the configuration file.
- NIS entries are now ignored when checking the password file.
- The use of '--disable all' on the command-line is now allowed
provided that the '--enable' option is also used, and not set
to 'none'. Disabling all the tests in the configuration file
will still give an error.
- If the enabled and disabled test name(s) are the same, then an
error will now be displayed. This only applies to certain
non-grouped test names.
- The check of syslog remote logging no longer considers a
127.x.x.x address as being remote.
- In the configuration file the WEBCMD option has now changed
name to WEB_CMD. However, the old name will still be recognised.
- If the UPDT_ON_OS_CHANGE option is set, and an O/S change has been
detected, a message is now logged stating that an automatic
update will occur. Additionally, the output of the update is no
longer displayed (it looked confusing).
- Removed the automatic exception of TDB database files from the
'filesystem' check. (This seems to have been introduced in version
1.1.3, but we have whitelisting now.)
- The file properties test now handles broken links. These were
previously reported as an error. If there are any broken links,
then the '--propupd' option will report how many have been found.
- The old configuration options LOCAL_RC_PATH and SYSTEM_RC_DIR
have now been removed. They were replaced by STARTUP_PATHS at
version 1.3.6.
- Most of the configuration options which take a list of pathnames,
and which are not set in the provided config file, can now be
specified more than once. They are all now space-separated lists
as well.
- The 'suspicious files' check in the 'running_procs' test now displays
each found file individually. Additionally the warning will include
the command being executed, the PID, the user id, the full pathname
that appears to be suspicious, and the possible rootkit name.
- Reverted a change to the 'os_specific' test so that it will show the
test as being skipped for O/S's which have no specific tests. Without
this if the test was enabled on its own, then nothing at all was
displayed.
- More rigorous testing of the various '.dat' files before each test
which uses them has now been included. If a problem is found, then
a warning is displayed.
- The ALLOW_SSH_ROOT_USER configuration option can no longer be set
to 'yes' if the 'PermitRootLogin' option is not set in the SSH
configuration file. A value of 'unset' must be used.
- The ALLOW_SSH_PROT_V1 configuration option can no longer be set
to '1' if the 'Protocol' option is not set in the SSH configuration
file. A value of '2' must be used. (The use of '1' in this instance
was an undocumented, but allowed setting.)
- The '--enable' and '--disable' command-line options may now be
specified more than once.
- The default behaviour when the command-line option '--disable' is
used has been changed. Rkhunter will now also include the
configuration file option used to disable tests, in order to
determine overall which tests to run. This is more intuitive for the
user. If the previous behaviour of only the '--disable' option being
used to determine which tests to run, then the new '--nocf' option
must also be used.
- The network 'ports' test no longer displays the details of the test
on the screen, but just shows the overall result. This brings the test
format more inline with the other tests. The result of individual
ports being checked is still logged as before.
- The 'sort' and 'uniq' commands are now required to be on the system
in order to run rkhunter.
- Grsecurity-enabled systems may now run the network 'ports' test. If
this causes a problem, then that particular test can be disabled.
- Improved support for OS X a little bit more.
- When using the installer '--show' option, if a directory does not
exist, then it will now state that the directory will be created.
- The 'hidden_procs' test used to run the 'unhide sys' command. Now
it is possible to specify which test names to provide to the 'unhide'
command by using the UNHIDE_TESTS configuration option. It defaults
to 'sys'. This allows for additional tests to be run with 'unhide'
if the user wishes, and caters for newer versions of 'unhide' which
have several new options. Increased the amount of logging of what
rkhunter is doing during the 'hidden_procs' test.
- Both the '--bindir' command-line option and the BINDIR configuration
file option may now be specified more than once. The description of
how these options affect the PATH of rkhunter has been reworded in
both the supplied rkhunter.conf file and the man page.
- The log file permissions and owner/group settings will now be copied
to each new log file, rather than a new log file, with default
permissions, being created each time. This will allow users to
modify the permissions/owner/group of the log file, without them
being lost when a new log file is created. If no log file exists,
then, as before, one will be created with permissions of 600 and
with the owner/group of the root user.
- For OS X users the test of root-equivalent accounts now works
with directory services as well as with the password files.
- The check of the syslog configuration file will now check all
the files found, not just the first one.

Bugfixes:
- Corrected test of ProFTPD version number in apps test.
- Make the apps test version number check case-independent.
- Ensure the promiscuous interface whitelisting is applied to both
parts of the test. Corrected and tidied up the displayed output.
- Correct the test of rkhunter itself being changed to a non-script
file.
- Ensure the suspscan test removes any files it creates. (Again!)
- The --rootdir/ROOTDIR configuration option now works correctly if
specified as '/'. Previously it caused the file properties file
entries to become a bit messed up.
- The file properties immutable test checked the 'lsattr' command
against the rkhunter configuration file. However, if the file was
a symbolic link, then the test failed. Now the test checks 'lsattr'
against several of the rkhunter installed files, looking for a
regular, non-link, file. These include the configuration file, the
rkhunter database files, and the language files.
- The ALLOWDEVFILE whitelisting now allows filenames to contain
colon (:) characters.
- The rootkit summary could list detected rootkit names more than once.
This has now been corrected, each rootkit name will only be
displayed once. The rootkit count will also now only show the number
of unique rootkits found.
- It was possible for part of the summary to be displayed twice. This
has now been corrected so that it only displays once.
- For system startup files (rc files), the rootkit strings check now
ignores comment lines (lines starting with '#'). For Solaris systems,
the 'gstrings' command is used rather than 'strings' if it exists.
- Allow *BSD 'grep' to work correctly with binary (i18n) files.
- Removed the configuration file option use of a comma as an option
separator. Now only spaces and tabs can be used. Use of a comma would
prevent known rootkit files and directories, as well as RCS files, from
being whitelisted correctly.
- When the German language is selected rkhunter will now try to display
messages using the correct encoding.
- The test of rootkit strings in the startup files could display the
wrong string and rootkit. It now displays the correct information.
- The 'filesystem' check now correctly identifies non-standard
directories (e.g. setgid directory), and allows them to be whitelisted.
- The UPDT_ON_OS_CHANGE option was defaulting to 1 rather than 0.
- The result of the libsafe check, a prelink command check, and a prelink
hash function check were not being reported.
- The 'filesystem' check would ignore files with spaces in their name if
the default setting of SCAN_MODE_DEV was used. This has now been
corrected, filenames with spaces in them are checked regardless of the
configuration option setting.
- If the installer is used with the RPM, TGZ or DEB layout options,
and '/' is the build root, then this will now build correctly.
- NetBSD, FreeBSD and OS X would print out an error regarding the 'print'
command. They would also display the locking messages incorrectly. Both
of these have now been corrected.
- The sockstat/netstat output check for *BSD systems gave a spurious
error message because FreeBSD/OpenBSD sockstat did not support the '-n'
option. This has been fixed, but NetBSD systems will still use it.
- The installer option '--layout custom /' now works correctly.
- The SHA256 perl module was not being called correctly.

To Upgrade:

yum upgrade rkhunter

More Articles...

<< Start < Prev 1 2 Next > End >>

Page 1 of 2