Dear All:
A couple of days ago I began receiving the following warning from RKHunter from
one of my servers running Ubintu:
Warning: The file properties have changed:
File: /usr/bin/sudo
Current hash: 5b41801698e37b78857458418637d3bdac1cf08a
Stored hash : fd64baa63407b55d179a7cbfe4e456b583a122dd
Current inode: 331526 Stored inode: 330883
Current file modification time: 1271180173
Stored file modification time : 1267140091One or more warnings have
been found while checking the system.
Please check the log file (/var/log/rkhunter.log)
Interestingly, at the same time, I also began receiving an almost identical
message from another server, also running Ubuntu:
Warning: The file properties have changed:
File: /usr/bin/sudo
Current hash: 4ecebaeb3b1318e4bbce4fa70983c82b56f0b47e
Stored hash : 4733c9940e32e5b82adfaa7fca6ad0d71f948bf4
Current inode: 22682756 Stored inode: 22676755
Current file modification time: 1271179891
Stored file modification time : 1267140355One or more warnings have
been found while checking the system.Please check the log file
(/var/log/rkhunter.log)
/var/log/dpkg.log shows the following happening on the 16th:2010-04-16 08:02:37
upgrade sudo 1.6.9p17-1ubuntu3.1 1.6.9p17-1ubuntu3.2...2010-04-16 08:02:37
status half-configured sudo 1.6.9p17-1ubuntu3.12010-04-16 08:02:37 status
unpacked sudo 1.6.9p17-1ubuntu3.12010-04-16 08:02:37 status half-installed sudo
1.6.9p17-1ubuntu3.1...2010-04-16 08:02:38 status half-installed sudo
1.6.9p17-1ubuntu3.12010-04-16 08:02:38 status half-installed sudo
1.6.9p17-1ubuntu3.1...2010-04-16 08:02:40 configure sudo 1.6.9p17-1ubuntu3.2
1.6.9p17-1ubuntu3.22010-04-16 08:02:40 status unpacked sudo
1.6.9p17-1ubuntu3.22010-04-16 08:02:40 status unpacked sudo
1.6.9p17-1ubuntu3.22010-04-16 08:02:40 status half-configured sudo
1.6.9p17-1ubuntu3.22010-04-16 08:02:40 status installed sudo
1.6.9p17-1ubuntu3.2...
chkrootkit does not appear to find any problem. It looks like Ubuntu updated
the sudo file but I wanted to float this for any feedback from the group. Has
anyone else seen this lately on an Ubuntu system? Do I now need to run
--propupd ?
Thanks in advance.Ralph
_________________________________________________________________
The New Busy is not the too busy. Combine all your e-mail accounts with Hotmail.
http://www.windowslive.com/campaign/thenewbusy?tile=multiaccount&ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_4------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
