[SOLVED] rkhunter repeated warnings

[stephan-zrh]

Hello,

We recently migrated to Plesk 12 (Centos 6.6). Ever since moving to the new container, rkhunter reports each night about elinks:

Code: Select all

---------------------- Start Rootkit Hunter Scan ----------------------
Warning: Package manager verification has failed:
         File: /usr/bin/elinks
         Try running the command 'prelink /usr/bin/elinks' to resolve dependency errors.
         The file hash value has changed
         The file size has changed

----------------------- End Rootkit Hunter Scan -----------------------

I've run 'prelink /usr/bin/elinks', also did 'rkhunter -chkupd' but still it reports the same issue each night.

Does anyone have an idea what might be causing this and how to get rid of that warning?

Kind regards

-Stephan

[biggles]

No idea what to do, but I have exactly the same problem.

[scott]

Reinstall elinks and run rkhunter --propupd?

[stephan-zrh]

Reinstall elinks and run rkhunter --propupd?

That worked. Thanks!

[dsjohn]

Does anyone have an idea what might be causing this ?

The problem is caused by update(s) of libraries used by the command(s) rkhunter is complaining about.
For elinks and other programs this happened to me when the library nns and other libraries were updated by auto yum.

On Fedora you can use this pipe to get information about packages that could have triggered the rkhunter report:

ldd `which elinks`| awk '{print $3}' | xargs -L1 rpm -qif | grep -B5 "`date +"%b %Y"`"

Look for install date to check if the date matches the time rkhunter started complaining.

Name : nss
Version : 3.19.3
Release : 1.0.fc21
Architecture: i686
Install Date: ons 19 aug 2015 04:43:25 CEST
Group : System Environment/Libraries
Size : 2494663
License : MPLv2.0
Signature : RSA/SHA256, tor 13 aug 2015 03:40:02 CEST, Key ID 89ad4e8795a43f54
Source RPM : nss-3.19.3-1.0.fc21.src.rpm
Build Date : ons 12 aug 2015 07:26:31 CEST
--
v3 certificates, and other security standards.
Name : nss
Version : 3.19.3
Release : 1.0.fc21
Architecture: i686
Install Date: ons 19 aug 2015 04:43:25 CEST
Group : System Environment/Libraries
Size : 2494663
License : MPLv2.0
Signature : RSA/SHA256, tor 13 aug 2015 03:40:02 CEST, Key ID 89ad4e8795a43f54
Source RPM : nss-3.19.3-1.0.fc21.src.rpm
Build Date : ons 12 aug 2015 07:26:31 CEST
--
v3 certificates, and other security standards.
Name : nss
Version : 3.19.3
Release : 1.0.fc21
Architecture: i686
Install Date: ons 19 aug 2015 04:43:25 CEST
Group : System Environment/Libraries
Size : 2494663
License : MPLv2.0
Signature : RSA/SHA256, tor 13 aug 2015 03:40:02 CEST, Key ID 89ad4e8795a43f54
Source RPM : nss-3.19.3-1.0.fc21.src.rpm
Build Date : ons 12 aug 2015 07:26:31 CEST