I noticed that app-forensics/chkrootkit comes with some crontabs in /etc/cron.weekly. At first I thought that was a great idea, but I don't think chkrootkit -q will notify root if there are any rootkits found. It would probably just silently list them in some console (most likely not even in the log).. Should we just remove the 2 cron related files from the ebuild? Or should we patch them to use some mail program? (or log it, and hope the admin uses logwatch?) Reproducible: Always Steps to Reproduce: 1. 2. 3.
Firstly, chkrootkit -q is silent *unless* it finds any rootkits. Secondly, if you have mail setup cron will automatically send *ANY* output to the user that the cronjob was run as (in this case, root). If you dont have mail setup, then it ends up in ~/dead.letter.
