Worried about having been hacked
Manuel Aróstegui
manuel at todo-linux.com
Wed Jul 8 10:24:35 UTC 2009
El mié, 08-07-2009 a las 10:59 +0100, James Allsopp escribió:
> Hi,
> I've checked this out and that was happening, but I've just had this
> reported by rkhunter;
>
> Warning: Package manager verification has failed:
> File: /bin/rpm
> Try running the command 'prelink /bin/rpm' to resolve
> dependency errors.
> The file hash value has changed
> The file size has changed
> Warning: Package manager verification has failed:
> File: /usr/bin/passwd
> Try running the command 'prelink /usr/bin/passwd' to resolve
> dependency errors.
> The file hash value has changed
> The file size has changed
> Warning: Package manager verification has failed:
> File: /usr/bin/perl
> Try running the command 'prelink /usr/bin/perl' to resolve
> dependency errors.
> The file hash value has changed
> The file size has changed
> Warning: Package manager verification has failed:
> File: /sbin/chkconfig
> Try running the command 'prelink /sbin/chkconfig' to resolve
> dependency errors.
> The file hash value has changed
> The file size has changed
>
> I'm not entirely sure what these errors mean though, have these files
> been trojan'ed.
If you updated your system that's perfectly normal.
Anything strange in /etc/passwd? Any user with uid 0 apart from root?
You might want to take a look at the "last" and make sure there's
nothing unusual there, strange hours, strange IPs...
Manuel.
--
Manuel Arostegui Ramirez.
Electronic Mail is not secure, might not be read every day, and should not
be used for urgent or sensitive issues.
More information about the fedora-list
mailing list