4

I am testing rkhunter on a Ubuntu server 16.04 in Virtualbox. I received an email alert by rkhunter on the 11th of October, inviting me to "Please inspect this machine, because it may be infected".

So I made a scan with rkhunter and found the following result:

$ sudo rkhunter -c --rwo
Warning: The file properties have changed:
         File: /usr/bin/curl
         Current hash: f025f2f2dca226c921b2b09da78b220656c098652d41c8654dc4853ff3fd1e5a
         Stored hash : cf846b7f3f11fc8af6cf79a2bbad3c8314eec72c1425b49bc9e34cf85a5090bb
         Current inode: 661569    Stored inode: 661888
         Current file modification time: 1507203916 (05-Oct-2017 13:45:16)
         Stored file modification time : 1478126766 (02-Nov-2016 23:46:06)

So I decided to check the curl package:

$ dpkg -S curl
$ echo $?
0

As you can see nothing was reported. I read a discussion at serverfault where it was suggested to check if the hash change was due to an automatic security update. Checking /var/log/apt/history.log I noticed that there was an unattended-upgrade of curl starting in 2017-10-11. I wonder: why rkhunter reports 05 October as the file modification date while the upgrade was made the 11 October?

terdon
  • 234,489
  • 66
  • 447
  • 667
Asarluhi
  • 317
  • 2
  • 5
  • 13

1 Answers1

4
sudo rkhunter --update --propupd

should be run after any apt upgrades automatically or manualy

user1133275
  • 5,488
  • 1
  • 19
  • 37