As is bound to happen... Every distro keeps certain files secheck check's for in differnt locations.
secheck is being developed primarily on a Red Hat system, so all of the script is garunteed to run on RH. If you, however, are not running RH, here are some notes I have collected along the way from users which you may find usefull if the script doesn't run correctly, or you get funny output.
- Debian uses 'exim' as a replacement for 'sendmail' IMPLICATION: The 'secheck' wrapper script uses the command 'mail' to send the output to the specified user. Exim has replaced '/usr/bin/mail' with /usr/bin/rmail. You will need to make the appropriate changes in the secheck wrapper script in /usr/local/etc/secheck.
- Debian keeps information about su and sudo in /var/log/auth.log IMPLICATION: The security.check script looks in /var/log/messages and greps for a string to bring back values of users who have su'd to root within the past 24 hours. If you are running debian, it won't find anything! If you look through the security.check script, you will find a line for debian users which can be uncommented. Use this and you will be set... Just comment out the RH line.
Bram Shirani
bram@aversion.net
http://secheck.sourceforge.net/