Home / server / Questions / 866226
Accepted
Steffen
Asked: 2017-08-02 00:26:39 +0800 CST

rkhunter: prelinking hash function warning

  • 772

We are using rkhunter to check to scan our server periodically. Server operating system is CentOS 6/7. But since last rkhunter update (to currently version 1.4.4) we getting following warning message:

[10:12:09] Performing file properties checks
[10:12:09] Warning: Checking for prerequisites               [ Warning ]
[10:12:09]          All file hash checks will be skipped because:
[10:12:09]              This system uses prelinking, but the hash function 
                        command does not look like SHA1 or MD5.

But we had prelinking all with:

/> prelink -a --md5

Anybody knows how I can prevent the message or what can be wrong?

linux

2 Answers

  1. Best Answer

    Delete the /etc/prelink.cache file. Run the prelink rebuild with /etc/cron.daily/prelink. Then run rkhunter --propupd.

    Then doing a rkhunter -c showed clean.

    From: https://sourceforge.net/p/rkhunter/mailman/message/35131677/

    Update: CentOS has since added an upgrade that removes the comment mark from the line HASH_CMD=sha1sum in the rkhunter.conf file.

    • 2

  2. I solved this indefinitely by running the following for each file listed in the Warning. For example, /bin/grep was as follows:

    prelink /bin/grep

    Then, running:

    rkhunter --propupd
    • 0