rkhunter warning message /bin/sh

Question

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain.

Warning: The file properties have changed:
         File: /bin/sh
         Current hash: fbc463bc858e28f38229e0b4711a895ca8a24a8a
         Stored hash : 80018ad5dc87488c52033d95cbcbb740a8bc89b7
         Current inode: 105064    Stored inode: 261
         Current file modification time: 1362564093 (06-Mar-2013 15:31:33)
         Stored file modification time : 1331099647 (07-Mar-2012 11:24:07)

Umm... so was `/bin/sh` one of the things you fully updated? — Michael Hampton, Sep 05 '13 at 14:03

score 0 · Answer 1 · answered Sep 05 '13 at 12:24

0

Yes, that you have a file property change on the file /bin/sh at 06 Mar 2013 and time 15:31:33. Someone changed the file properties.

Maybe an ls -l /bin/sh give you what have been changed at 06 Mar 2013. Also maybe the file properties changed due to an update that you have done.

answered Sep 05 '13 at 12:24

anksos

163
1
3
11

Yes, that the file have been changed doesn't mean that its compromised. But you must check if it is this change due to an update or not. Then you will know. But in most case the most cause is due to an update/patch. – anksos Sep 05 '13 at 13:18

rkhunter warning message /bin/sh

1 Answers1