LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-28-2011, 02:52 AM   #1
qwertyjjj
Senior Member
 
Registered: Jul 2009
Location: UK
Distribution: Cent OS5 with Plesk
Posts: 1,004

Rep: Reputation: 30
rkhunter warnings


For no apparent reason, I have started to receive a load of rkhunter warnings about files in/usr/bin. They are mostly going on about a Bourne_Again script text.
Is this a false positive or is there something else that could be amiss? There do not seem to be any rootkits present in the system.

However, nothing shows up in the log although a lot of the files have this instead:
[08:41:59] Warning: Package manager verification has failed:
[08:41:59] File: /usr/bin/sha512sum
[08:41:59] Try running the command 'prelink /usr/bin/sha512sum' to resolve dependency errors.
[08:41:59] The file hash value has changed
[08:41:59] The file size has changed

Is this a bug?

Code:
[08:40:52]   Checking for prerequisites                      [ OK ]
[08:41:01]   /sbin/chkconfig                                 [ Warning ]
[08:41:01] Warning: Package manager verification has failed:
[08:41:01]          File: /sbin/chkconfig
[08:41:01]          Try running the command 'prelink /sbin/chkconfig' to resolve dependency errors.
[08:41:01]          The file hash value has changed
[08:41:01]          The file size has changed
[08:41:01]   /sbin/depmod                                    [ Warning ]
[08:41:01] Warning: Package manager verification has failed:
[08:41:01]          File: /sbin/depmod
[08:41:01]          Try running the command 'prelink /sbin/depmod' to resolve dependency errors.
[08:41:01]          The file hash value has changed
[08:41:01]          The file size has changed
[08:41:02]   /sbin/fsck                                      [ Warning ]
[08:41:02] Warning: Package manager verification has failed:
[08:41:02]          File: /sbin/fsck
[08:41:02]          Try running the command 'prelink /sbin/fsck' to resolve dependency errors.
[08:41:02]          The file hash value has changed
[08:41:02]          The file size has changed
[08:41:02]   /sbin/fuser                                     [ Warning ]
[08:41:02] Warning: Package manager verification has failed:
[08:41:02]          File: /sbin/fuser
[08:41:02]          Try running the command 'prelink /sbin/fuser' to resolve dependency errors.
[08:41:02]          The file hash value has changed
[08:41:02]          The file size has changed
[08:41:03]   /sbin/ifconfig                                  [ Warning ]

Last edited by qwertyjjj; 04-28-2011 at 02:57 AM.
 
Old 04-28-2011, 04:05 AM   #2
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Ubuntu 10.10, Slackware 64-current
Posts: 2,124

Rep: Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776
Quote:
For no apparent reason, I have started to receive a load of rkhunter warnings about files in/usr/bin. ... The file hash value has changed ... The file size has changed
Did you recently perform an update your system? This would be the most likely cause. If so, the database stored in rkhunter is probably out of date.

From the rkhunter manpages:
Quote:
WARNING: It is the users responsibility to ensure that the files on the system are genuine and from a reliable source. rkhunter can only report if a file has changed, but not on what has caused the change. Hence, if a file has changed, and the --propupd command option is used, then rkhunter will assume that the file is genuine.
From your post profile, it looks like you are running CentOS. In this case you should be able to verify your installed files against the repository easily. I believe the command is RPM -vV. See this link from rpm.org.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
rkhunter warnings....how do I fix these...5 of them cbjhawks Linux - Security 6 12-31-2011 10:19 AM
[SOLVED] rkhunter warnings skoinga Linux - Security 1 12-23-2010 10:49 AM
Three new Rkhunter warnings... Amdx2_x64 Linux - Security 2 10-27-2010 10:48 PM
rkhunter warnings adityavpratap Slackware 15 02-24-2007 07:11 AM
rkhunter warnings jantman Linux - Security 4 01-23-2007 02:39 PM


All times are GMT -5. The time now is 01:24 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration