Home / server / Questions / 537427
In Process
Zhen
Asked: 2013-09-10 01:52:48 +0800 CST

RKHunter reports change in file properties, but different hash length

  • 772

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash.

[11:47:13] Warning: The file properties have changed:
[11:47:13]          File: /sbin/chkconfig
[11:47:13]          Current hash: f01e642124a8ed7dc5f0fa6b5a7d33e214e3c752
[11:47:13]          Stored hash : d495988a86fd9a3c308ea869e5f3c1de42d58e830d0c5ffbcba25db8e8b641b0
[11:47:13]          Current size: 35264    Stored size: 31728

Is it something misconfigured or a real problem?

UPDATE: RKHunter warn in all the files checked with hash with different length. It appears to be a problem of different hash algorithms used.

linux

1 Answers

  1. Is this the only rkhunter warning that you got? Have you been running rkhunter for a time without this problem and it just started? Did you update chkconfig recently? Check your /var/log/yum.log to see if chkconfig has been updated by yum. The file definitely changed, at far is rkhunter is concerned, so you will have to determine if it was a legitimate change through an expected update, or if it was nefarious.

    • 0