[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Should I install chkrootkit?



Joe <joe@jretrading.com> writes:

>> next question: how does one see a 'hidden file' if one receives a
>> warning in rkhunter about having two on your system? I can always
>> delete /etc/.java and /etc/.fstab but what then? (why the 'dot' in
>> front of the .java and .fstab)
>> 
>> Warning: Hidden directory found: '/etc/.java'
>> Warning: Hidden file found: /etc/.fstab: ASCII text
>> 
>> thanks for your considerable comment so far
>> 
>
> Most GUI file managers have a setting in the View menu or Preferences
> for displaying hidden files, the dotted files are normally some kind of
> system or configuration file, which you usually don't want cluttering a
> display of work files. You'll find plenty of dotted files and
> directories in your home directory.
>
> You might want to install mc, the Midnight Commander, and run it from
> the command line for this kind of task. It shows everything and has a
> simple and fairly robust text editor built in, as well as many file
> processing commands. It's also easy to run as root using su or sudo,
> with a GUI file manager you'll have to call it from the command line or
> locate a 'File Manager as Root' menu entry. I don't like running GUI
> file managers as root because I may forget, but I know if I'm using
> mc, I'm doing something a bit non-standard, and I need to be careful.
>
> I also don't have complete faith in GUI text editors to show me what's
> really there, and I don't really like resorting to a hex editor for
> what are basically text files, so mc is a good compromise. For me,
> anyway.
>
> -- 
> Joe

Dired mode in emacs is also very good for this. You can tranparantly
access files as root or on remote servers, it handles compressed files,
encrypted files, tar files, files under version control etc. It can be
used with a gui interface and it works just as well in text mode. And it
has an editor too ;-).

To view the files in /etc, you would use C-x C-f (find-file) and type
/sudo::/etc when prompted for the filename. Or /su::/etc if you haven't
set up sudo.  If you are running emacs as root, you can just type /etc.

And, of course the -A option for ls will also show you the file starting
with a dot.

$ ls -lA

Attachment: pgpgSuwGL751W.pgp
Description: PGP signature


Reply to: