rkhunter warnings

Gene Heskett gene.heskett at verizon.net
Thu Oct 12 15:54:00 UTC 2006


Timothy Alberts wrote:
> On Thu, 2006-10-12 at 19:10 +0530, Vikram Goyal wrote:
>> Hello,
>>
>> I'm using FC5 and recently I started getting warnings from rkhunter cron
>> check. I manually also updated the hashes with same results.
>>
>> What may be the reason??? Any ideas...Anything to worry...
>>
>> * System tools
>> Info: prelinked files found
>> Performing 'known good' check...
>>  /bin/cat  [ BAD ]
>>  /bin/chmod  [ BAD ]
>>  /bin/chown  [ BAD ]
>>  /bin/date  [ BAD ]
>>  /bin/dmesg  [ BAD ]
>>  /bin/env  [ BAD ]
>>  /bin/grep  [ BAD ]
>>  /bin/kill  [ BAD ]
>>  /bin/login  [ BAD ]
>> <snip>
>>  /usr/bin/whoami  [ BAD ]
>> --------------------------------------------------------------------------------
>> Rootkit Hunter found some bad or unknown hashes. This can be happen due replaced
>> binaries or updated packages (which give other hashes). Be sure your hashes are
>> fully updated (rkhunter --update). If you're in doubt about these hashes, contact
>> the author (fill in the contact form).
>> --------------------------------------------------------------------------------
>> <snip>
> 
> 
>  I get these too, but only on one of the machines?
> 
> 
I get a whole boatload of these from the md5 check, everything else is 
cool.  Time for a new version of rkhunter?

-- 
Cheers, Gene




More information about the fedora-list mailing list