I got the above message last night from chkrootkit. I haven't touched
my /root/.bash_history. Are there any programs that modify this?

There's no other evidence of a break-in.

I've confirmed that this file has zero size:

# cd
debian:~# ls -l .bash_history
-rw------- 1 root root 0 Oct 28 08:03 .bash_history

What do you suggest that I do?


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Tuesday 28 October 2008, "Robert Schmidli"
<robert.spam.me.senseless@gmail.com> wrote about 'Chkrootkit
reports "Warning: `//root/.bash_history' file size is zero"':
>I got the above message last night from chkrootkit. I haven't touched
>my /root/.bash_history. Are there any programs that modify this?

bash and it's built-ins touch this file all the time. I generally wouldn't
worry about changes to it, unless you happen to use history expansion
often to refer to commands typed in previous sessions.
--
Boyd Stephen Smith Jr. ,= ,-_-. =.
bss03@volumehost.net ((_/)o o(\_))
ICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-'
http://iguanasuicide.org/ \_/