Re: [Rkhunter-users] missing hashes 3

[John H. <joh...@pl...>]

On Tue, 2007-12-25 at 12:54 +0000, Dogsbody wrote:
> Hi,
> 
> After upgrading my operating system (CentOS 4.5 to 4.6) I am getting some errors 
>   I don't quite understand.  After upgrading I did a --propupd.
> 
> # rkhunter --propupd
> [ Rootkit Hunter version 1.3.0 ]
> File updated: searched for 147 files, found 124, missing hashes 3
> 
> # rkhunter --cronjob --report-warnings-only
> Warning: No hash value found for file '/usr/bin/less' in the rkhunter.dat file.
> Warning: No hash value found for file '/usr/bin/lynx' in the rkhunter.dat file.
> Warning: No hash value found for file '/usr/bin/pstree' in the rkhunter.dat file.
> 
> # grep /less /var/log/rkhunter.log
> [12:26:32] /usr/bin/less                                     [ Warning ]
> [12:26:32] Warning: No hash value found for file '/usr/bin/less' in the 
> rkhunter.dat file.
> 
It's a known problem caused by prelinking
(https://bugzilla.redhat.com/show_bug.cgi?id=240658). The rkhunter.dat
file will have entries for these commands, but as the message says no
*hash* entry. If you run something like 'prelink /usr/bin/less' you will
get an error. This is what RKH sees.

The FAQ file also mentions about the 'missing hashes' error.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 233914
E-mail: Joh...@pl...       Fax: +44 (0)1752 233839