I have a few false positive scans on my rkhunter. However I did a scan today
and these results do kinda worry me, I have 8 warnings now. I will post the
warnings that Im not sure about.
/usr/sbin/runlevel [ Warning
/usr/bin/sudo [ Warning
/usr/bin/systemd [ Warning ]
/usr/bin/systemctl [ Warning ]
/usr/lib/systemd/systemd [ Warning ]
These are the new warnings that showed up. I looked into the log and found this.
[23:25:11] /usr/sbin/runlevel [ Warning ]
[23:25:11] Warning: The file properties have changed:
[23:25:11] File: /usr/sbin/runlevel
[23:25:11] Current hash: f48396b4d8fbf906a0a12ec5f9581a119fe266b0d61919c251e8320bd099327a
[23:25:11] Stored hash : a9c198f924de92ab40633d345c55b6e84986e6e58f5569220871af3edeaca069
[23:25:11] Current inode: 25954758 Stored inode: 25954035
[23:25:11] Current file modification time: 1679322728 (20-Mar-2023 10:32:08)
[23:25:11] Stored file modification time : 1677761882 (02-Mar-2023 07:58:02)
[23:25:18] /usr/bin/sudo [ Warning ]
[23:25:18] Warning: The file properties have changed:
[23:25:18] File: /usr/bin/sudo
[23:25:18] Current hash: 7d3c2983ad2f278d9e799b5792f13f57bf890bd3b03d10b36e53bf0b6677895e
[23:25:18] Stored hash : 49278c0ebbc089cc04cfa6136a8011519fbaca9d99106443212e43c2141a7ff9
[23:25:18] Current inode: 25957682 Stored inode: 25953068
[23:25:18] Current file modification time: 1680544844 (03-Apr-2023 14:00:44)
[23:25:18] Stored file modification time : 1677679177 (01-Mar-2023 08:59:37)
[23:25:19] Warning: The file properties have changed:
[23:25:19] File: /usr/bin/systemd
[23:25:19] Current hash: 477209848fabcaf52c060d98287f880845cb07fc9696216dbcfe9b6ea8e72bcd
[23:25:19] Stored hash : c76a78e1572f62e0b28e0e5c459bd475917eb92177bdbeedf965d22c261b0f82
[23:25:19] Current inode: 25957781 Stored inode: 25956458
[23:25:19] Current file modification time: 1679322728 (20-Mar-2023 10:32:08)
[23:25:19] Stored file modification time : 1677761882 (02-Mar-2023 07:58:02)
[23:25:19] /usr/bin/systemctl [ Warning ]
[23:25:19] Warning: The file properties have changed:
[23:25:19] File: /usr/bin/systemctl
[23:25:19] Current hash: f48396b4d8fbf906a0a12ec5f9581a119fe266b0d61919c251e8320bd099327a
[23:25:19] Stored hash : a9c198f924de92ab40633d345c55b6e84986e6e58f5569220871af3edeaca069
[23:25:19] Current inode: 25953751 Stored inode: 25954081
[23:25:19] Current size: 1119856 Stored size: 1115760
[23:25:19] Current file modification time: 1679322728 (20-Mar-2023 10:32:08)
[23:25:19] Stored file modification time : 1677761882 (02-Mar-2023 07:58:02)
23:25:22] /usr/lib/systemd/systemd [ Warning ]
[23:25:22] Warning: The file properties have changed:
[23:25:22] File: /usr/lib/systemd/systemd
[23:25:22] Current hash: 477209848fabcaf52c060d98287f880845cb07fc9696216dbcfe9b6ea8e72bcd
[23:25:22] Stored hash : c76a78e1572f62e0b28e0e5c459bd475917eb92177bdbeedf965d22c261b0f82
[23:25:22] Current inode: 25954768 Stored inode: 25956371
[23:25:22] Current file modification time: 1679322728 (20-Mar-2023 10:32:08)
[23:25:22] Stored file modification time : 1677761882 (02-Mar-2023 07:58:02)
I really need help on this to find out if this is a false positive or not. Systemd
does concern me along with the other warnings. Thanks.
Update
A user told me to look at recent updates and I remember I did do some updates linux wanted me to do in the past 2 days and I found in history of updates some lines libsystemd0, systemd-coredump, libnss-systemd,systemd, libpam-systemd and other updates. Seeing all these updates involving systemd is a sure sign of false positives. I need to look at my update history more after these scans. Im gonna look at the man page in rkhunter to restore every warning to OK. Its solved.
Asked by Linuxuser75
(21 rep)
Apr 14, 2023, 04:10 AM
Last activity: Jun 2, 2023, 09:56 AM
Last activity: Jun 2, 2023, 09:56 AM