Is there any posibilitie that snort changes the grep, egrep and fgreps binaries??
Yesterday i have installed snort with default conf and today, when I ran rkhunter, the three appears as modified.
Those are the only binaries that appears to be modified.
In the other hands, the only suspicious in the logs are the automated ssh login attempts.
I will copy those files from another machine, but first i will like to hear your opinions.

Thanks.

No. I actually just tested this just to be sure (I was putting Snort on a test system). It shouldn't change the MD5sums on any of them. Did RKHunter tell you what failed (maybe something other than md5sum)? If you're using an rpm-based system try using the following to verify package integrity:

rpm -V grep

If not, try comparing it's md5sum to a known good version.

That's the error rkhunter displays:

/usr/sbin/prelink: /bin/egrep: at least one of file's dependencies has changed since prelinking
/bin/egrep [ BAD ]

May be is something silly, but, i'm in doubt.

Thanks.

strange.

ldd /bin/egrep

any weird stuff their?

you should see libc and ld-linux

ldd /bin/egrep
libpcre.so.0 => /usr/local/lib/libpcre.so.0 (0x00acf000)
libc.so.6 => /lib/tls/libc.so.6 (0x00191000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00178000)

That's what it displays. libc and ld-linux are there, i don't know if libpcre must be there. But I assume it must be there, since is the perl compatible regex library.

I Don't see anything strange. That's weird.

when I ran rkhunter, the three appears as modified.
Those are the only binaries that appears to be modified.
Rkhunter ships with static md5sum lists and should not be used as the most important or even single point of authority when it comes to verifying sums. Running a filesystem checker like Aide or Samhain is a better option. if you save their databases on readonly media, just after you installed your OS, it's even better than verifying against your OSes package manager databases.


In the other hands, the only suspicious in the logs are the automated ssh login attempts.
Good thing you verified your logs. Should be one of the first things on one's mind on a networked box.


/usr/sbin/prelink: /bin/egrep: at least one of file's dependencies has changed since prelinking
/bin/egrep [ BAD ]
It's in the Rkhunter FAQ under "Errors from external software": E1: run /etc/cron.daily/prelink.