unsp...@hushmail.com wrote:
> Let's not guess or speculate but ask you to post nfo:
> - from syslog or yum.log the packages that got installed as deps of
ImageMagick,
Nov 11 08:45:21 Updated: libacl-2.2.39-8.el5.x86_64
Nov 11 08:45:22 Installed: libgsf-1.14.1-6.1.x86_64
Nov 11 08:45:22 Installed: libfontenc-1.0.2-2.2.el5.x86_64
Nov 11 08:45:22 Installed: libXfont-1.2.2-1.0.4.el5_7.x86_64
Nov 11 08:45:22 Installed: 1:xorg-x11-font-utils-7.1-3.x86_64
Nov 11 08:45:22 Installed: libcroco-0.6.1-2.1.x86_64
Nov 11 08:45:22 Updated: gamin-0.1.7-10.el5.x86_64
Nov 11 08:45:22 Installed: ttmkfdir-3.0.9-23.el5.x86_64
Nov 11 08:45:23 Installed: libFS-1.0.0-3.1.x86_64
Nov 11 08:45:23 Installed: lcms-1.18-0.1.beta1.el5_3.2.x86_64
Nov 11 08:45:23 Installed: libwmf-0.2.8.4-10.2.x86_64
Nov 11 08:45:23 Installed: avahi-0.6.16-10.el5_6.i386
Nov 11 08:45:23 Installed: libattr-2.4.32-1.1.i386
Nov 11 08:45:24 Installed: libacl-2.2.39-8.el5.i386
Nov 11 08:45:24 Installed: avahi-glib-0.6.16-10.el5_6.i386
Nov 11 08:45:24 Installed: libIDL-0.8.7-1.fc6.i386
Nov 11 08:45:24 Installed: ORBit2-2.14.3-5.el5.i386
Nov 11 08:45:25 Installed: GConf2-2.14.0-9.el5.i386
Nov 11 08:45:26 Installed: libbonobo-2.16.0-1.1.el5_5.1.i386
Nov 11 08:45:26 Installed: gamin-0.1.7-10.el5.i386
Nov 11 08:45:27 Installed: gnome-vfs2-2.16.2-8.el5.i386
Nov 11 08:45:27 Installed: librsvg2-2.16.1-1.el5.x86_64
Nov 11 08:45:28 Installed: libgsf-1.14.1-6.1.i386
Nov 11 08:45:28 Installed: libcroco-0.6.1-2.1.i386
Nov 11 08:45:28 Installed: librsvg2-2.16.1-1.el5.i386
Nov 11 08:45:28 Installed: libwmf-0.2.8.4-10.2.i386
Nov 11 08:45:28 Installed: lcms-1.18-0.1.beta1.el5_3.2.i386
Nov 11 08:45:28 Updated: acl-2.2.39-8.el5.x86_64
Nov 11 08:45:28 Installed: chkfontpath-1.10.1-1.1.x86_64
Nov 11 08:45:31 Installed: urw-fonts-2.3-6.1.1.noarch
Nov 11 08:45:33 Installed: ghostscript-8.70-14.el5_8.1.x86_64
Nov 11 08:45:35 Installed: ghostscript-fonts-5.50-13.1.1.noarch
Nov 11 08:45:36 Installed: 1:xorg-x11-xfs-1.0.2-5.el5_6.1.x86_64
Nov 11 08:45:37 Installed: ImageMagick-6.2.8.0-15.el5_8.x86_64
Nov 11 08:45:39 Installed: ghostscript-8.70-14.el5_8.1.i386
Nov 11 08:45:40 Installed: ImageMagick-6.2.8.0-15.el5_8.i386
> - the result of running 'rpm -Vv' on those package names filtered with
'grep -v "^\.\{8\}",
That yields:
package 1:xorg-x11-font-utils-7.1-3.x86_64 is not installed
package 1:xorg-x11-xfs-1.0.2-5.el5_6.1.x86_64 is not installed
Was that what you expected?
The unfiltered output contains a long list of files that have been
changed; they do not include any of the ones identified by RKHunter (see
below).
> - the relevant rkhunter.log entries.
[04:04:40] /bin/tcsh [ Warning ]
[04:04:40] Warning: The file properties have changed:
[04:04:40] File: /bin/tcsh
[04:04:40] Current hash: Unavailable
[04:04:41] Stored hash : eb1fc564a9ae8947339ccb7229bbb1bcc2858b87
[04:04:41] Try running the command 'prelink /bin/tcsh' to resolve
dependency errors.
[04:04:41] /usr/sbin/adduser [ OK ]
[04:04:41] /usr/sbin/chroot [ OK ]
[04:04:41] /usr/sbin/groupadd [ Warning ]
[04:04:41] Warning: The file properties have changed:
[04:04:41] File: /usr/sbin/groupadd
[04:04:41] Current hash: Unavailable
[04:04:41] Stored hash : 0cd9817545f4f8bd8780dd90a3b49215bee7b95b
[04:04:41] Try running the command 'prelink /usr/sbin/groupadd'
to resolve dependency errors.
[04:04:41] /usr/sbin/groupdel [ Warning ]
[04:04:41] Warning: The file properties have changed:
[04:04:41] File: /usr/sbin/groupdel
[04:04:41] Current hash: Unavailable
[04:04:41] Stored hash : a08849a7cfcca39894441c005d39c43e0ed3548d
[04:04:41] Try running the command 'prelink /usr/sbin/groupdel'
to resolve dependency errors.
[04:04:42] /usr/sbin/groupmod [ Warning ]
[04:04:42] Warning: The file properties have changed:
[04:04:42] File: /usr/sbin/groupmod
[04:04:42] Current hash: Unavailable
[04:04:42] Stored hash : fdc370a9873d52e2b60b5d6c7147837b8e8d845c
[04:04:42] Try running the command 'prelink /usr/sbin/groupmod'
to resolve dependency errors.
[04:04:42] /usr/sbin/grpck [ Warning ]
[04:04:42] Warning: The file properties have changed:
[04:04:42] File: /usr/sbin/grpck
[04:04:42] Current hash: Unavailable
[04:04:42] Stored hash : 9cb37fcf1c7873a644aa45d4c917846e1b701dc6
[04:04:42] Try running the command 'prelink /usr/sbin/grpck' to
resolve dependency errors.
[04:04:42] /usr/sbin/kudzu [ OK ]
[04:04:43] /usr/sbin/prelink [ OK ]
[04:04:43] /usr/sbin/pwck [ Warning ]
[04:04:43] Warning: The file properties have changed:
[04:04:43] File: /usr/sbin/pwck
[04:04:43] Current hash: Unavailable
[04:04:43] Stored hash : f725b6b58296870cd09291ea19179b3284f5e786
[04:04:43] Try running the command 'prelink /usr/sbin/pwck' to
resolve dependency errors.
[04:04:46] /usr/bin/lastlog [ Warning ]
[04:04:46] Warning: The file properties have changed:
[04:04:46] File: /usr/bin/lastlog
[04:04:46] Current hash: Unavailable
[04:04:46] Stored hash : 06bf0ba31256bf48d557979baf6e3152200218ba
[04:04:46] Try running the command 'prelink /usr/bin/lastlog' to
resolve dependency errors.
[04:04:47] /usr/bin/md5sum [ OK ]
[04:04:47] /usr/bin/newgrp [ Warning ]
[04:04:47] Warning: The file properties have changed:
[04:04:47] File: /usr/bin/newgrp
[04:04:47] Current hash: Unavailable
[04:04:47] Stored hash : 47c7f213c709fff5828cb8d760a24610e53e43ce
[04:04:47] Try running the command 'prelink /usr/bin/newgrp' to
resolve dependency errors.
[04:04:48] /usr/bin/passwd [ Warning ]
[04:04:48] Warning: The file properties have changed:
[04:04:48] File: /usr/bin/passwd
[04:04:48] Current hash: Unavailable
[04:04:48] Stored hash : ad18c16f689622f4eed9b67264f3ce1b6b277a4c
[04:04:48] Try running the command 'prelink /usr/bin/passwd' to
resolve dependency errors.
[04:04:48] /usr/bin/perl [ Warning ]
[04:04:48] Warning: The file properties have changed:
[04:04:48] File: /usr/bin/perl
[04:04:48] Current hash: Unavailable
[04:04:48] Stored hash : e7435448df8f92d5ac07cdc4d54ab7485030fce6
[04:04:48] Try running the command 'prelink /usr/bin/perl' to
resolve dependency errors.
[04:04:48] /usr/bin/pgrep [ OK ]
(some snippage to leave out a bunch of files that RKHunter saw as OK).
RKHunter does not report any known rootkits or other issues.
I think this may relate to one of your FAQs, about unfindable hashes, but
I'm not sure why those particular files should have changed.
Thanks for your help, and for any more light that you can shed on this.
Angus
------------------------------------------------------------------------------
Monitor your physical, virtual and cloud infrastructure from a single
web console. Get in-depth insight into apps, servers, databases, vmware,
SAP, cloud infrastructure, etc. Download 30-day Free Trial.
Pricing starts from $795 for 25 servers or applications!
http://p.sf.net/sfu/zoho_dev2dev_nov
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
