2

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash.

[11:47:13] Warning: The file properties have changed:
[11:47:13]          File: /sbin/chkconfig
[11:47:13]          Current hash: f01e642124a8ed7dc5f0fa6b5a7d33e214e3c752
[11:47:13]          Stored hash : d495988a86fd9a3c308ea869e5f3c1de42d58e830d0c5ffbcba25db8e8b641b0
[11:47:13]          Current size: 35264    Stored size: 31728

Is it something misconfigured or a real problem?

UPDATE: RKHunter warn in all the files checked with hash with different length. It appears to be a problem of different hash algorithms used.

Zhen
  • 2,109
  • 4
  • 19
  • 31

1 Answers1

0

Is this the only rkhunter warning that you got? Have you been running rkhunter for a time without this problem and it just started? Did you update chkconfig recently? Check your /var/log/yum.log to see if chkconfig has been updated by yum. The file definitely changed, at far is rkhunter is concerned, so you will have to determine if it was a legitimate change through an expected update, or if it was nefarious.

Jesse
  • 341
  • 2
  • 8
  • RKHunter warn in all the files checked with hash with different length. It appears to be a problem of different hash algorithms used. – Zhen Sep 23 '13 at 18:46