☰

rkhunter 報告檔案屬性發生更改，但我沒有看到它們已被 yum 更新

tag-icon • tag-icon yum hacking update packages rkhunter
rkhunter 報告檔案屬性發生更改，但我沒有看到它們已被 yum 更新

也許我過於謹慎了，但我最近收到了來自 rkhunter 的以下警告：

Warning: The file properties have changed:
        File: /bin/dmesg
        Current hash: e94b12f49e53695bf5161a445c00b3f97e37e9a8
        Stored hash : 4cc922b102987beea5ec3e10f283b08cfd942658
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/kill
        Current hash: 12f2d4e21474ccdb989c9ee4d4102917e51d8d7b
        Stored hash : 8e14ca5dbdc158a833c2d861bf682e31aae24675
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/logger
        Current hash: 08f2886e3ef1fa5adb34ed8b24477362206f85c6
        Stored hash : c2bf21ac162bc7de5f6c0b787c304707127e5d96
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/login
        Current hash: d05eb12a1184d3babcf3380674293974b8a2dcce
        Stored hash : 4849447380595bbff3aacc1a1ac90e59f7289ca6
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/more
        Current hash: e2bad443495de0c23be2f87f836f80eafa3ba330
        Stored hash : afb55b42873a210a5cec07baa106faa3829cae41
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /bin/mount
        Current hash: cfda891d89dc57c94327bd62845f8ef13c42ff54
        Stored hash : 32d8659bad80b43acc4e437510a88491c9c53294
        Current file modification time: 1263983789 (20-Jan-2010 05:36:29)
        Stored file modification time : 1252007547 (03-Sep-2009 15:52:27)
Warning: The file properties have changed:
        File: /usr/bin/kill
        Current hash: 12f2d4e21474ccdb989c9ee4d4102917e51d8d7b
        Stored hash : 8e14ca5dbdc158a833c2d861bf682e31aae24675
        Current file modification time: 1264059189 (21-Jan-2010 02:33:09)
        Stored file modification time : 1256283752 (23-Oct-2009 03:42:32)
Warning: The file properties have changed:
        File: /usr/bin/logger
        Current hash: 08f2886e3ef1fa5adb34ed8b24477362206f85c6
        Stored hash : c2bf21ac162bc7de5f6c0b787c304707127e5d96
        Current file modification time: 1264059189 (21-Jan-2010 02:33:09)
        Stored file modification time : 1256283752 (23-Oct-2009 03:42:32)
Warning: The file properties have changed:
        File: /usr/bin/whereis
        Current hash: 0d700404e6cfd49bc1ef39465a586706b3b9f008
        Stored hash : 1552446e1285fd3d361e0198149e0a946ee7f28b
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /sbin/nologin
        Current hash: 01b82549a312108b655cca21993d2b24a56f3c7e
        Stored hash : 61255119451e25eb27e6e9a4ca67219564896d4f
        Current file modification time: 1263983792 (20-Jan-2010 05:36:33)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)
Warning: The file properties have changed:
        File: /usr/sbin/vipw
        Current hash: da7bc573ef2c55f1f7e1a7ebb964dbf1187c2702
        Stored hash : dc50bdcb381833d6e8e12cc7af81b37a0b3c4c8e
        Current file modification time: 1263983792 (20-Jan-2010 05:36:32)
        Stored file modification time : 1252007551 (03-Sep-2009 15:52:31)

通常，我會檢查 yum 日誌以查看這些文件最近是否已更新，但我沒有看到它們：

Jan 21 02:33:08 Updated: 30:bind-libs-9.3.6-4.P1.el5_4.2.x86_64
Jan 21 02:33:08 Updated: perl-Compress-Raw-Zlib-2.024-1.el5.rf.x86_64
Jan 21 02:33:08 Updated: perl-Compress-Raw-Bzip2-2.024-1.el5.rf.x86_64
Jan 21 02:33:09 Updated: 30:bind-9.3.6-4.P1.el5_4.2.x86_64
Jan 21 02:33:09 Updated: 1:cups-libs-1.3.7-11.el5_4.5.x86_64
Jan 21 02:33:11 Updated: util-linux-2.13-0.52.el5_4.1.x86_64
Jan 21 02:33:11 Updated: gzip-1.3.5-11.el5.centos.1.x86_64
Jan 21 02:33:11 Updated: perl-IO-Compress-2.024-1.el5.rf.noarch
Jan 21 02:33:16 Updated: 30:caching-nameserver-9.3.6-4.P1.el5_4.2.x86_64
Jan 21 02:33:18 Updated: kernel-headers-2.6.18-164.11.1.el5.x86_64
Jan 21 02:33:18 Updated: 1:cups-libs-1.3.7-11.el5_4.5.i386

當我查看日誌檔案時，我是否遺漏了一些東西？這些軟體包之一會導致所有這些軟體包的更新嗎？也許是 util-linux？

我知道運行 rkhunter --propupd 會重置它掃描的基本文件信息，但我只是想確保我不應該首先擔心這些結果。被修改的軟體包似乎可以被用於駭客攻擊。

最後運行不會顯示任何可疑登入。

答案1

我剛剛在我這裡的 64 位 CentOS 機器上使用了命令“yum 提供 /path/binary”，所有這些二進位檔案都是 util-linux 軟體包的一部分。這已在您最近的更新中列出。

答案2

您是否有可能在從現在到 2009 年 9 月 3 日之間的某個時間點使用過「prelink」。

--md5

這與 --verify 選項類似，只不過在列印預先連結到標準輸出 MD5 摘要之前不是輸出二進位檔案或函式庫的內容。請參閱 md5sum(1)。

檢查這些二進位文件，如果它是預先連結導致它們更改，那麼它應該與您記錄的值相符。

相關內容