Just in case anyone will face with it. Problem was in immutable flag setted on /usr/sbin/NetworkManager. The case is when you are trying to update such binary, system can't re-write it (download new file with additional symbols, which are maybe memory segment where new binary is, delete old one, rename a new one). As a result you may have a bunch of usr/sbin/NetworkManager with additional symbols. In system output you may not see it so as ";" is a separator and the name will be always /usr/sbin/NetworkManager, but RKHunter works with strings I suppose, so it shows process how it is -- usr/sbin/NetworkManager;5cyt67yr
In other words, nothing criminal. To fix it delete all files with additional simbols, get rid of immutable flag and reinstal the whole package. нд, 26 трав. 2019 о 02:50 John Horne <john.ho...@plymouth.ac.uk> пише: > On Sun, 2019-05-26 at 00:19 +0300, Olexandra Bokova wrote: > > Hi! > > > > Thank you for reply! > > > > I haven't got access to the server right now. I can give the message in > two > > days, if you need. But the main and only warning there is: > > > > Warning: Process '/usr/sbin/NetworkManager;5cyt67yr' (PID 2813) is > listening > > on the network. > > > I think we'll need to see the output from a debug run of rkhunter. Can you > run > rkhunter with the '--debug' option and send me a copy of the file it > produces > in '/tmp' please. > > > Thanks, > > John. > > -- > John Horne | Senior Operations Analyst | Technology and Information > Services > University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK > ________________________________ > [http://www.plymouth.ac.uk/images/email_footer.gif]< > http://www.plymouth.ac.uk/worldclass> > > This email and any files with it are confidential and intended solely for > the use of the recipient to whom it is addressed. If you are not the > intended recipient then copying, distribution or other use of the > information contained is strictly prohibited and you should not rely on it. > If you have received this email in error please let the sender know > immediately and delete it from your system(s). Internet emails are not > necessarily secure. While we take every care, University of Plymouth > accepts no responsibility for viruses and it is your responsibility to scan > emails and their attachments. University of Plymouth does not accept > responsibility for any changes made after it was sent. Nothing in this > email or its attachments constitutes an order for goods or services unless > accompanied by an official order form. > > _______________________________________________ > Rkhunter-users mailing list > Rkhunter-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/rkhunter-users >
_______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
