Good evening, I don't know if these are properly rkhunter questions, yum questions, or F-20 questions, so I'm posting to both lists.
Last Monday, I updated my 64-bit system from Fedora-19 to Fedora-20. Several minutes ago, I updated Fedora-20 by doing "yum update". I then did "rkhunter --update", and then "rkhunter --check". I'm getting a lot of issues. 1. I get these messages in the rkhunter log: [18:55:34] Info: The command 'rpm -qf --queryformat... /usr/sbin/chkconfig' gave error code 1. [18:55:39] Info: The command 'rpm -qf --queryformat... /usr/sbin/fuser' gave error code 1. [18:55:40] Info: The command 'rpm -qf --queryformat... /usr/sbin/ifconfig' gave error code 1. [18:55:44] Info: The command 'rpm -qf --queryformat... /usr/sbin/route' gave error code 1. [18:55:44] Info: The command 'rpm -qf --queryformat... /usr/sbin/rsyslogd' gave error code 1. [18:55:50] Info: The command 'rpm -qf --queryformat... /usr/bin/ed' gave error code 1. [18:55:50] Info: The command 'rpm -qf --queryformat... /usr/bin/egrep' gave error code 1. [18:55:50] Info: The command 'rpm -qf --queryformat... /usr/bin/fgrep' gave error code 1. [18:55:52] Info: The command 'rpm -qf --queryformat... /usr/bin/grep' gave error code 1. [18:55:55] Info: The command 'rpm -qf --queryformat... /usr/bin/mail' gave error code 1. [18:55:55] Info: The command 'rpm -qf --queryformat... /usr/bin/netstat' gave error code 1. [18:56:01] Info: The command 'rpm -qf --queryformat... /usr/bin/rpm' gave error code 1. [18:56:01] Info: The command 'rpm -qf --queryformat... /usr/bin/sed' gave error code 1. [18:56:07] Info: The command 'rpm -qf --queryformat... /usr/bin/mailx' gave error code 1. I get these warnings a lot (both under F-19, and since updating to F-20). What's causing these warnings? Is there something yum should be doing, but isn't? Is there something I should be doing, but I don't know it? 2. I get this warning in the rkhunter log: [18:55:49] /usr/bin/curl [ Warning ] [18:55:49] Warning: Package manager verification has failed: [18:55:49] File: /usr/bin/curl [18:55:49] Try running the command 'prelink /usr/bin/curl' to resolve dependency errors. [18:55:49] The file hash value has changed [18:55:49] The file size has changed The warning gives me the immediate fix, and it works. But the problem recurs after almost every "yum update" (both under F-19, and since updating to F-20), though not on the same packages each time. What's the real problem? Is there something yum should be doing, but isn't? Is there something I should be doing, but I don't know it? 3. Since updating to F-20, I'm seeing this warning: [18:56:18] [18:56:18] Checking for GasKit Rootkit... [18:56:18] Checking for file '/dev/dev/gaskit/sshd/sshdd' [ Not found ] [18:56:18] Checking for directory '/dev/dev' [ Found ] [18:56:18] Checking for directory '/dev/dev/gaskit' [ Not found ] [18:56:18] Checking for directory '/dev/dev/gaskit/sshd' [ Not found ] [18:56:18] Warning: GasKit Rootkit [ Warning ] [18:56:18] Directory '/dev/dev' found [18:56:18] The directory "/dev/dev/" contains one entry: bash.6[dev]: ll total 0 lrwxrwxrwx. 1 root root 10 Jan 29 13:48 resume -> ../../sda5 bash.7[dev]: Doing "file resume" gives this: bash.21[dev]: file resume resume: broken symbolic link to `../../sda5' bash.22[dev]: I see no "sda5" in the root directory. A "df" shows no filesystem. An "ls -a" of the root directory shows one file I did not expect: -rw-r--r--. 1 root root 178665 Jan 29 18:50 .readahead It seems to be binary. Do I have a security problem? What are "/dev/dev/resume" and "/.readahead"? thanks, Bill. ------------------------------------------------------------------------------ WatchGuard Dimension instantly turns raw network data into actionable security intelligence. It gives you real-time visual feedback on key security issues and trends. Skip the complicated setup - simply import a virtual appliance and go from zero to informed in seconds. http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
