[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Worried about having been hacked



On Wed, 2009-07-08 at 12:08 +0100, James Allsopp wrote:
> Hi,
> I've checked all the files you asked me to. The following is the files
> from the yum whatprovides followed by that grepped on /var/log/
> 
> chkconfig-1.3.38-1.i386
> Mar 26 00:53:01 Updated: chkconfig-1.3.38-1.i386
> rpm-4.6.1-1.fc10.i386
> Jun 10 08:34:24 Updated: rpm-4.6.1-1.fc10.i386
> passwd-0.75-2.fc9.i386
> never been updated.
> perl-5.10.0-68.fc10.i386
> Apr 22 16:54:07 Updated: 4:perl-5.10.0-68.fc10.i386
> 
> 
> This machine was installed about August 2008. The /usr/bin/passwd is
> shown in red, which I think indicates a broken symbolic link?
> 
> [root 87-194-141-15 ~]# which chkconfig
> /sbin/chkconfig
> [root 87-194-141-15 ~]# ls -l /sbin/chkconfig
> -rwxr-xr-x 1 root root 28000 2008-10-29 15:35 /sbin/chkconfig
> 
> [root 87-194-141-15 ~]# which passwd
> /usr/bin/passwd
> [root 87-194-141-15 ~]# ls -l /usr/bin/passwd
> -rwsr-xr-x 1 root root 25700 2008-04-08 14:48 /usr/bin/passwd
> 
> [root 87-194-141-15 ~]# which rpm
> /bin/rpm
> [root 87-194-141-15 ~]# ls -l /bin/rpm
> -rwxr-xr-x 1 root root 23240 2009-05-18 12:26 /bin/rpm
> 
> [root 87-194-141-15 ~]# which perl
> /usr/bin/perl
> [root 87-194-141-15 ~]# ls -l /usr/bin/perl
> -rwxr-xr-x 2 root root 8140 2009-04-14 12:26 /usr/bin/perl
> 
> 
> 
> None of these files seems new, but could they have been altered? This
> is the first time I've seen this in rkhunter.
> Jim
> 
The message means that some part of the system - libraries probably -
have been changed and hence the prelinking of commands (passwd,
chkconfig etc) now requires to be redone. Hence you get the warning
message, and an advisory to run the 'prelink' command.

Your system will, at some time, automatically prelink the relevant
commands/libraries, but if you want to avoid the rkhunter warnings until
then, then run the suggested prelink commands.

Run the shown prelink comands and then run:

  rkhunter --enable properties

The warnings should have gone.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: John Horne plymouth ac uk       Fax: +44 (0)1752 587001


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]