Hello, On Wed, 13 Feb 2008 06:17:02 +0100 Sheldon King <[EMAIL PROTECTED]> wrote: >Recently on my new systems I have been having problems keeping >rkhunter hashes updated. >I get [ WARN ] on like 27 different binaries and cant get it to go >away! If you look at your rkhunter.conf, what value do you use for PKGMGR? Did you check out the whitelisting options?
>Now I realize that I am not hacked because I just updated my >server As with all auditing tools RKH can only provide you with warnings. Some warnings are unambiguous in their outcome but even then it is the users responsability (and it should be a SOP) to follow that up with any second opinion methods the system provides like using filesystem integrity checker like Aide, Samhain or even tripwire, or the verification methods provided by your distro's package manager (if any). >[EMAIL PROTECTED] scripts]# sh hashupd.sh It's one of John's improvements to 1.3.0 that "hashupd" isn't necessary anymore. >/etc/cron.daily/prelink: line 47: 8337 Aborted (..) >Prelinking /usr/bin/diff >Prelink failed with return value 134 Interestngly enough this mailing list has seen some prelinking errors before but IIRC not this one and I'm not sure if it has any bearing on RKH. Maybe search through & chalk up a report at your distro's bugtracker? -- Great pay, great benefits, rewarding. Click for information on a healthcare career. http://tagline.hushmail.com/fc/Ioyw6h4fNQwYLh2BP6xg2jKe9TBi6c9nA8ZdisZDc4DtksNqpR5NUc/ Regards, unSpawn ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
