Worried about having been hacked

[John Horne]

On Wed, 2009-07-08 at 12:08 +0100, James Allsopp wrote:
> Hi,
> I've checked all the files you asked me to. The following is the files
> from the yum whatprovides followed by that grepped on /var/log/
> 
> chkconfig-1.3.38-1.i386
> Mar 26 00:53:01 Updated: chkconfig-1.3.38-1.i386
> rpm-4.6.1-1.fc10.i386
> Jun 10 08:34:24 Updated: rpm-4.6.1-1.fc10.i386
> passwd-0.75-2.fc9.i386
> never been updated.
> perl-5.10.0-68.fc10.i386
> Apr 22 16:54:07 Updated: 4:perl-5.10.0-68.fc10.i386
> 
> 
> This machine was installed about August 2008. The /usr/bin/passwd is
> shown in red, which I think indicates a broken symbolic link?
> 
> [root at 87-194-141-15 ~]# which chkconfig
> /sbin/chkconfig
> [root at 87-194-141-15 ~]# ls -l /sbin/chkconfig
> -rwxr-xr-x 1 root root 28000 2008-10-29 15:35 /sbin/chkconfig
> 
> [root at 87-194-141-15 ~]# which passwd
> /usr/bin/passwd
> [root at 87-194-141-15 ~]# ls -l /usr/bin/passwd
> -rwsr-xr-x 1 root root 25700 2008-04-08 14:48 /usr/bin/passwd
> 
> [root at 87-194-141-15 ~]# which rpm
> /bin/rpm
> [root at 87-194-141-15 ~]# ls -l /bin/rpm
> -rwxr-xr-x 1 root root 23240 2009-05-18 12:26 /bin/rpm
> 
> [root at 87-194-141-15 ~]# which perl
> /usr/bin/perl
> [root at 87-194-141-15 ~]# ls -l /usr/bin/perl
> -rwxr-xr-x 2 root root 8140 2009-04-14 12:26 /usr/bin/perl
> 
> 
> 
> None of these files seems new, but could they have been altered? This
> is the first time I've seen this in rkhunter.
> Jim
> 
The message means that some part of the system - libraries probably -
have been changed and hence the prelinking of commands (passwd,
chkconfig etc) now requires to be redone. Hence you get the warning
message, and an advisory to run the 'prelink' command.

Your system will, at some time, automatically prelink the relevant
commands/libraries, but if you want to avoid the rkhunter warnings until
then, then run the suggested prelink commands.

Run the shown prelink comands and then run:

  rkhunter --enable properties

The warnings should have gone.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: John.Horne at plymouth.ac.uk       Fax: +44 (0)1752 587001