Alright, there was an update yesterday that had something to do with passwd (assuming it was to do with the VMbuilder vulnerability posted here: http://www.ubuntu.com/usn/usn-670-1)
I ran an RKhunter scan today and had multiple warnings come up...
I'm assuming this is because RKhunter was ran after the update, and I understand that the file hash would change because of the new file, but I want to know how to correct this and update the system so these errors don't persist.
I've already ran: sudo updatedb
But after that, I ran RKhunter again, and the errors were still present.
Here are the errors:
I ran the 'last' command in a terminal, and didn't notice anything out of the norm, other than a 'guest' login on Nov. 3rd, but I have been using the new Guest account feature in Ibex and am assuming that this is related to that.Code:[15:45:56] /bin/su [ Warning ] [15:45:56] Warning: The file properties have changed: [15:45:56] File: /bin/su [15:45:56] Current hash: 48a5cab28938bf1203f390854583b61a3a21d377 [15:45:56] Stored hash : fb0641d828a93ab17df08e733262d6db1fe4c517 [15:45:56] Current inode: 690173 Stored inode: 688240 [15:45:56] Current file modification time: 1226559294 [15:45:56] Stored file modification time : 1213035031 [15:46:04] /usr/bin/lastlog [ Warning ] [15:46:04] Warning: The file properties have changed: [15:46:04] File: /usr/bin/lastlog [15:46:04] Current hash: 40027e152c4592f482a731e90eb5415cf31484ca [15:46:04] Stored hash : a559592a93fc50f3660d90b9fc1974f8994602f9 [15:46:04] Current inode: 158758 Stored inode: 156231 [15:46:04] Current file modification time: 1226559294 [15:46:04] Stored file modification time : 1213035031 [15:46:07] /usr/bin/newgrp [ Warning ] [15:46:08] Warning: The file properties have changed: [15:46:08] File: /usr/bin/newgrp [15:46:08] Current hash: 243e49e5cc0d4870cd1a425291056f09f3b565f0 [15:46:08] Stored hash : 863fb21f9e4cc33553778012fd22ba4cf50c4449 [15:46:08] Current inode: 158759 Stored inode: 156345 [15:46:08] Current file modification time: 1226559294 [15:46:08] Stored file modification time : 1213035031 [15:46:08] /usr/bin/passwd [ Warning ] [15:46:08] Warning: The file properties have changed: [15:46:08] File: /usr/bin/passwd [15:46:08] Current hash: a20df24d8a8b7970be0081167dcd0663d09ce1da [15:46:08] Stored hash : e0f1aaa29d21fde2b63c18129a267b5b326163a9 [15:46:09] Current inode: 159384 Stored inode: 156406 [15:46:09] Current file modification time: 1226559291 [15:46:09] Stored file modification time : 1213035028 [15:46:27] /usr/sbin/groupadd [ Warning ] [15:46:27] Warning: The file properties have changed: [15:46:27] File: /usr/sbin/groupadd [15:46:27] Current hash: 1cf5376f629acb6393eb920120d7ba4a778ec403 [15:46:27] Stored hash : c779a59c49f83c8c503a9fc960448253f21d4ca4 [15:46:27] Current inode: 159388 Stored inode: 158253 [15:46:28] Current file modification time: 1226559291 [15:46:28] Stored file modification time : 1213035028 [15:46:28] /usr/sbin/groupdel [ Warning ] [15:46:28] Warning: The file properties have changed: [15:46:28] File: /usr/sbin/groupdel [15:46:28] Current hash: e1567e1051b2ad21923b48bf49e5ffa2fc4b92ea [15:46:28] Stored hash : 25c5a23047c12bab286c0240246f4b12e1a4a7dd [15:46:28] Current inode: 159389 Stored inode: 158254 [15:46:28] Current file modification time: 1226559291 [15:46:28] Stored file modification time : 1213035028 [15:46:28] /usr/sbin/groupmod [ Warning ] [15:46:29] Warning: The file properties have changed: [15:46:29] File: /usr/sbin/groupmod [15:46:29] Current hash: 7a82ce60545ddbf3dddfac0fb8503c502f230624 [15:46:29] Stored hash : 6970642c6d6f6b447f6ac883bf749aa95942c0f9 [15:46:29] Current inode: 159390 Stored inode: 158255 [15:46:29] Current file modification time: 1226559291 [15:46:29] Stored file modification time : 1213035028 [15:46:29] /usr/sbin/grpck [ Warning ] [15:46:29] Warning: The file properties have changed: [15:46:29] File: /usr/sbin/grpck [15:46:29] Current hash: 71a2f30f88cd2b45b2738c2728dee2bbc0e5b7c8 [15:46:29] Stored hash : bad92a89ed925cd04c51d57f7be28475bda663c2 [15:46:29] Current inode: 159391 Stored inode: 158256 [15:46:30] Current file modification time: 1226559291 [15:46:30] Stored file modification time : 1213035028 [15:46:30] /usr/sbin/nologin [ Warning ] [15:46:30] Warning: The file properties have changed: [15:46:30] File: /usr/sbin/nologin [15:46:30] Current hash: c77ff7059bb28b299e26e120c7b2f5c16997bc2c [15:46:31] Stored hash : 8a9070374223b8fb9836d790ce35669e614a8509 [15:46:31] Current inode: 158756 Stored inode: 158320 [15:46:31] Current file modification time: 1226559294 [15:46:31] Stored file modification time : 1213035031 [15:46:31] /usr/sbin/pwck [ Warning ] [15:46:31] Warning: The file properties have changed: [15:46:31] File: /usr/sbin/pwck [15:46:31] Current hash: 8ce0a3042cb92ba5095068c0f7bf946f640d7488 [15:46:31] Stored hash : 127d9d06265d7758dad7672f95eedf2208266379 [15:46:31] Current inode: 159395 Stored inode: 158348 [15:46:31] Current file modification time: 1226559291 [15:46:31] Stored file modification time : 1213035028 [15:46:33] /usr/sbin/useradd [ Warning ] [15:46:33] Warning: The file properties have changed: [15:46:33] File: /usr/sbin/useradd [15:46:33] Current hash: a836bf82da6f1e8d33735ef677107312ba0b235b [15:46:33] Stored hash : c06843dcb0aa247baa50f64b53dd92e8c2134a86 [15:46:33] Current inode: 159398 Stored inode: 158417 [15:46:33] Current file modification time: 1226559291 [15:46:33] Stored file modification time : 1213035028 [15:46:33] /usr/sbin/userdel [ Warning ] [15:46:33] Warning: The file properties have changed: [15:46:33] File: /usr/sbin/userdel [15:46:34] Current hash: 3f6802229e013d59e9ca76729af2fd27a1ece04e [15:46:34] Stored hash : 36bdbf3447087e27795e07197812ad8940e09ecb [15:46:34] Current inode: 159399 Stored inode: 158418 [15:46:34] Current file modification time: 1226559291 [15:46:34] Stored file modification time : 1213035028 [15:46:34] /usr/sbin/usermod [ Warning ] [15:46:34] Warning: The file properties have changed: [15:46:34] File: /usr/sbin/usermod [15:46:34] Current hash: 616aec6adf64cd037b41082505dc3d34047d9773 [15:46:34] Stored hash : 0e3694793d0b22b384e9b70f57f3e3ee4188b490 [15:46:34] Current inode: 159400 Stored inode: 158419 [15:46:34] Current file modification time: 1226559291 [15:46:34] Stored file modification time : 1213035028 [15:46:35] /usr/sbin/vipw [ Warning ] [15:46:35] Warning: The file properties have changed: [15:46:35] File: /usr/sbin/vipw [15:46:35] Current hash: bee92da96d5ab2f37b489d0cb73fabc4c4a62ba2 [15:46:35] Stored hash : 7f6d6bb3b2a99e41b759b61121ea7fa14e1e19ca [15:46:35] Current inode: 159401 Stored inode: 158427 [15:46:35] Current file modification time: 1226559291 [15:46:35] Stored file modification time : 1213035028
Also, I don't have anything in my 3rd party repos other than the Intrepid Partner repos, the official VLC nightlies, the medibuntu repo and the Google Picasa repo.
Thanks
Bookmarks