[Risolto] warnings di Rkhunter
Inviato: venerdì 26 dicembre 2008, 21:24
Stamattina ho fatto una scansione di routine con rkhunter e mi ha datao 16 warnings
ovviamente ho stralciato tutto il resto.
I files che mi mette in evidenza riportano tutti la data di modificazione del 08/12/2008, a parte uno (usr/bin/perl) che riporta la data di modificazione del 22/12/2008.
Credo che ció che mi riporta questo log é il prodotto di aggiornamenti di sicurezza, ma non sono riuscito a trovare il modo di confermarlo.
Qualcuno mi puó dare una mano?
Codice: Seleziona tutto
[10:51:02] Running Rootkit Hunter version 1.3.2 on luca-desktop
[10:51:02]
[10:51:02] Info: Start date is vie dic 26 10:51:02 PET 2008
[10:51:02]
[10:51:27] /bin/login [ Warning ]
[10:51:27] Warning: The file properties have changed:
[10:51:28] File: /bin/login
[10:51:28] Current hash: 670dfeceb51ad4d5ad6dafa41cc945e64eedb2a1
[10:51:28] Stored hash : cd736fab9e0d49b72ad1436623bc1604ce8da5ed
[10:51:28] Current inode: 393246 Stored inode: 390155
[10:51:28] Current file modification time: 1228728173
[10:51:28] Stored file modification time : 1226559432
[10:51:35] /bin/su [ Warning ]
[10:51:35] Warning: The file properties have changed:
[10:51:35] File: /bin/su
[10:51:35] Current inode: 393247 Stored inode: 390169
[10:51:35] Current file modification time: 1228728173
[10:51:35] Stored file modification time : 1226559432
[10:51:46] /usr/bin/lastlog [ Warning ]
[10:51:47] Warning: The file properties have changed:
[10:51:47] File: /usr/bin/lastlog
[10:51:47] Current inode: 216636 Stored inode: 216086
[10:51:47] Current file modification time: 1228728173
[10:51:47] Stored file modification time : 1226559432
[10:51:52] /usr/bin/newgrp [ Warning ]
[10:51:52] Warning: The file properties have changed:
[10:51:52] File: /usr/bin/newgrp
[10:51:52] Current inode: 216825 Stored inode: 216098
[10:51:52] Current file modification time: 1228728173
[10:51:52] Stored file modification time : 1226559432
[10:51:53] /usr/bin/passwd [ Warning ]
[10:51:53] Warning: The file properties have changed:
[10:51:53] File: /usr/bin/passwd
[10:51:53] Current inode: 217594 Stored inode: 433916
[10:51:53] Current file modification time: 1228728171
[10:51:53] Stored file modification time : 1226559429
[10:51:54] /usr/bin/perl [ Warning ]
[10:51:54] Warning: The file properties have changed:
[10:51:54] File: /usr/bin/perl
[10:51:54] Current hash: a96c8d80317b8396d708941f8199446ca54eca80
[10:51:54] Stored hash : 9c81bf31293a919f378949c44c996c3bbf422916
[10:51:54] Current inode: 213076 Stored inode: 212353
[10:51:54] Current file modification time: 1230001795
[10:51:54] Stored file modification time : 1216891131
[10:52:20] /usr/sbin/groupadd [ Warning ]
[10:52:20] Warning: The file properties have changed:
[10:52:20] File: /usr/sbin/groupadd
[10:52:21] Current inode: 217598 Stored inode: 468044
[10:52:21] Current file modification time: 1228728171
[10:52:21] Stored file modification time : 1226559429
[10:52:21] /usr/sbin/groupdel [ Warning ]
[10:52:21] Warning: The file properties have changed:
[10:52:21] File: /usr/sbin/groupdel
[10:52:21] Current inode: 217599 Stored inode: 468045
[10:52:21] Current file modification time: 1228728171
[10:52:22] Stored file modification time : 1226559429
[10:52:22] /usr/sbin/groupmod [ Warning ]
[10:52:22] Warning: The file properties have changed:
[10:52:22] File: /usr/sbin/groupmod
[10:52:22] Current inode: 217600 Stored inode: 468047
[10:52:22] Current file modification time: 1228728171
[10:52:22] Stored file modification time : 1226559429
[10:52:23] /usr/sbin/grpck [ Warning ]
[10:52:23] Warning: The file properties have changed:
[10:52:23] File: /usr/sbin/grpck
[10:52:23] Current inode: 217601 Stored inode: 468049
[10:52:23] Current file modification time: 1228728171
[10:52:23] Stored file modification time : 1226559429
[10:52:24] /usr/sbin/nologin [ Warning ]
[10:52:25] Warning: The file properties have changed:
[10:52:25] File: /usr/sbin/nologin
[10:52:25] Current inode: 216627 Stored inode: 216082
[10:52:25] Current file modification time: 1228728173
[10:52:25] Stored file modification time : 1226559432
[10:52:25] /usr/sbin/pwck [ Warning ]
[10:52:26] Warning: The file properties have changed:
[10:52:26] File: /usr/sbin/pwck
[10:52:26] Current inode: 217605 Stored inode: 468057
[10:52:26] Current file modification time: 1228728171
[10:52:26] Stored file modification time : 1226559429
[10:52:28] /usr/sbin/useradd [ Warning ]
[10:52:28] Warning: The file properties have changed:
[10:52:28] File: /usr/sbin/useradd
[10:52:28] Current inode: 217646 Stored inode: 468063
[10:52:28] Current file modification time: 1228728171
[10:52:28] Stored file modification time : 1226559429
[10:52:29] /usr/sbin/userdel [ Warning ]
[10:52:29] Warning: The file properties have changed:
[10:52:29] File: /usr/sbin/userdel
[10:52:29] Current inode: 217648 Stored inode: 468065
[10:52:29] Current file modification time: 1228728171
[10:52:29] Stored file modification time : 1226559429
[10:52:30] /usr/sbin/usermod [ Warning ]
[10:52:30] Warning: The file properties have changed:
[10:52:30] File: /usr/sbin/usermod
[10:52:30] Current inode: 217653 Stored inode: 468068
[10:52:30] Current file modification time: 1228728171
[10:52:30] Stored file modification time : 1226559429
[10:52:30] /usr/sbin/vipw [ Warning ]
[10:52:31] Warning: The file properties have changed:
[10:52:31] File: /usr/sbin/vipw
[10:52:31] Current inode: 217656 Stored inode: 468070
[10:52:31] Current file modification time: 1228728171
[10:52:31] Stored file modification time : 1226559429I files che mi mette in evidenza riportano tutti la data di modificazione del 08/12/2008, a parte uno (usr/bin/perl) che riporta la data di modificazione del 22/12/2008.
Credo che ció che mi riporta questo log é il prodotto di aggiornamenti di sicurezza, ma non sono riuscito a trovare il modo di confermarlo.
Qualcuno mi puó dare una mano?