Fedora Account System
Red Hat Associate
Red Hat Customer
This bug is identical to Bug 849251, but the file names have changed. In newer versions of FreeIPA (v3.x), the path has changed to "/var/log/pki/pki-tomcat/ca/system" The following would be the whitelist fix for the default rkhunter file: EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
ok, and to be clear this affects fedora 19 and higher only?
I can't be certain of the restriction to F19. I think it affects versions of FreeIPA of 3.x (so F18, too), but I don't have an example. I believe it might be a factor of the change to Dogtag 10. I can also say that there needs to be something like the following as well: # created by FreeIPA/389 DS ALLOWDEVFILE=/dev/shm/sem.slapd-WHATEVER-COM.stats As this file is created by 389-ds-base -- this need for ALLOWDEVFILE occurs in F17-F19.
Sorry for the long delay here. Is this "WHATEVER-COM" variable, or is that really litterally "WHATEVER-COM" ?
(In reply to Kevin Fenzi from comment #3) > Sorry for the long delay here. > > Is this "WHATEVER-COM" variable, or is that really litterally "WHATEVER-COM" > ? No problem... It is not literally "WHATEVER-COM". It is the Kerberos domain of the FreeIPA instance with dots translated to dashes. So it could be ALLOWDEVFILE=/dev/shm/sem.slapd-SUBSUBSUBDOMAIN-SUBSUBDOMAIN-SUBDOMAIN-SLD-TLD.stats
ok, so: ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats ?
(In reply to Kevin Fenzi from comment #5) > ok, so: > > ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats > > ? I believe so. Also, this is the case for all 389 DS instances, not just FreeIPA, if that's of any importance to you. Basically, the '*' portion is named after the instance name in /etc/dirsrv.
The following works for F20, on systems with both FreeIPA (including 389 DS) as well as systems with standalone 389 DS: # 389 Directory Server ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats # FreeIPA Certificate Authority EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system # FreeIPA Certificate Authority RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
rkhunter-1.4.2-2.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/rkhunter-1.4.2-2.fc20
rkhunter-1.4.2-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.