21 Jul
2013
21 Jul
'13
7:22 p.m.
Hi Adam,
On Sat, Jul 20, 2013 at 06:13:01PM +0100, Adam Spiers wrote:
I was away on holiday for a while recently, during
which time (on 21st
June to be precise) rkhunter started sending me daily report emails
like the one below, indicating that the perl and curl binaries on my
Debian 6.0.7 webserver changed. As far as I'm aware, my system only
[…]
dpkg -s says that I have curl-7.21.0-2.1+squeeze3 and
perl-5.10.1-17squeeze6, and debsums says everything's OK.
If debsums is okay with it then you could report it as a bug on the
rkhunter package?
Warning: The file properties have changed:
File: /usr/bin/perl
Current hash: 400681f383f4a2b63d4615a8d7ad53<wbr>c2a685e3da
Stored hash : be5055e1642bec794804ebf8668a15<wbr>54864d218b
Current inode: 33794 Stored inode: 33812
Current file modification time: 1362591932 (06-Mar-2013 17:45:32)
Stored file modification time : 1361046751 (16-Feb-2013 20:32:31)
On a squeeze system I have access to with that package version:
$ shasum /usr/bin/perl
400681f383f4a2b63d4615a8d7ad53c2a685e3da /usr/bin/perl
So that matches. Also debsums matches for me, which means the md5sum
also matches.
$ md5sum /usr/bin/perl
80ca00a4ba32c5dd89b89681ebc22f20 /usr/bin/perl
Won't the apt log confirm that you upgraded the relevant packages
and put your mind at rest?
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
The optimum programming team size is 1.
Has
Jurassic Park taught us nothing? — pfilandr