Re: [Rkhunter-users] chattr and lsattr on el4.5 x86_64

[Angus M. <an...@po...>]

At 11:23 AM +1000 2/24/08, Michael Mansour wrote:
>Ok thanks for this. No idea why these two files would have changed, as
>checking various other 32bit servers there's no problems.

Just for reference, I also get warnings about those two files, 
although mine are a little different from the ones you're seeing:

Warning: The file properties have changed:
          File: /usr/bin/chattr
          Current hash: eb6d475355fa361c7ed178fb7957250c88651e83
          Stored hash : 404497836caccbddd250332f805f8951ed756f49
          Current inode: 590062    Stored inode: 590680
          Current size: 9768    Stored size: 9864
          Current file modification time: 1197491388
          Stored file modification time : 1172235860
Warning: The file properties have changed:
          File: /usr/bin/lsattr
          Current hash: 193479adca680b272c9b919639ddf1ba60eb0be7
          Stored hash : 95513183776bfcebd20f9b4473cc1a1d12d22cd4
          Current inode: 589849    Stored inode: 589877
          Current size: 8492    Stored size: 8440
          Current file modification time: 1197491388
          Stored file modification time : 1172235860

I started getting hash warnings recently about three files: 'curl', 
which was expected, because I updated the package, and those two, 
which wasn't.

The modification time for those files (as determined by 'ls') is a 
time before the system was installed on the box in question.

Fedora Core 7, 64-bit x86, rkhunter 1.30.

Angus