Re: [Rkhunter-users] False warning about /usr/sbin/vipw
Brought to you by:
dogsbody
From: John H. <joh...@pl...> - 2008-11-04 12:33:17
|
On Fri, 2008-10-31 at 18:14 +0000, Dick Gevers wrote: > Using rkhunter 1.3.3. cvs of 6th October 2008 I have to report that once > only I get a warning for this file in today's 16.50 h cronjob. Not before > and not after: > > > [16:52:35] //usr/sbin/vipw [ Warning ] > [16:52:35] Warning: The file properties have changed: > [16:52:35] File: //usr/sbin/vipw > [16:52:35] Current hash: 37f1adce84d73bb92921c3bbdc074e919ce01d3d > [16:52:35] Stored hash : 575d90229ec34de850e99c08c6eb4bec > Looks like the hash function has changed - possibly from MD5 to SHA1. John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: Joh...@pl... Fax: +44 (0)1752 587001 |