On Wed, 2009-07-08 at 12:08 +0100, James Allsopp wrote: > Hi, > I've checked all the files you asked me to. The following is the files > from the yum whatprovides followed by that grepped on /var/log/ > > chkconfig-1.3.38-1.i386 > Mar 26 00:53:01 Updated: chkconfig-1.3.38-1.i386 > rpm-4.6.1-1.fc10.i386 > Jun 10 08:34:24 Updated: rpm-4.6.1-1.fc10.i386 > passwd-0.75-2.fc9.i386 > never been updated. > perl-5.10.0-68.fc10.i386 > Apr 22 16:54:07 Updated: 4:perl-5.10.0-68.fc10.i386 > > > This machine was installed about August 2008. The /usr/bin/passwd is > shown in red, which I think indicates a broken symbolic link? > > [root@87-194-141-15 ~]# which chkconfig > /sbin/chkconfig > [root@87-194-141-15 ~]# ls -l /sbin/chkconfig > -rwxr-xr-x 1 root root 28000 2008-10-29 15:35 /sbin/chkconfig > > [root@87-194-141-15 ~]# which passwd > /usr/bin/passwd > [root@87-194-141-15 ~]# ls -l /usr/bin/passwd > -rwsr-xr-x 1 root root 25700 2008-04-08 14:48 /usr/bin/passwd > > [root@87-194-141-15 ~]# which rpm > /bin/rpm > [root@87-194-141-15 ~]# ls -l /bin/rpm > -rwxr-xr-x 1 root root 23240 2009-05-18 12:26 /bin/rpm > > [root@87-194-141-15 ~]# which perl > /usr/bin/perl > [root@87-194-141-15 ~]# ls -l /usr/bin/perl > -rwxr-xr-x 2 root root 8140 2009-04-14 12:26 /usr/bin/perl > > > > None of these files seems new, but could they have been altered? This > is the first time I've seen this in rkhunter. > Jim > The message means that some part of the system - libraries probably - have been changed and hence the prelinking of commands (passwd, chkconfig etc) now requires to be redone. Hence you get the warning message, and an advisory to run the 'prelink' command. Your system will, at some time, automatically prelink the relevant commands/libraries, but if you want to avoid the rkhunter warnings until then, then run the suggested prelink commands. Run the shown prelink comands and then run: rkhunter --enable properties The warnings should have gone. John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne@xxxxxxxxxxxxxx Fax: +44 (0)1752 587001 -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
