[Rkhunter-users] missing hashes 3

[Dogsbody]

Hi,

After upgrading my operating system (CentOS 4.5 to 4.6) I am getting some errors
I don't quite understand. After upgrading I did a --propupd.

# rkhunter --propupd
[ Rootkit Hunter version 1.3.0 ]
File updated: searched for 147 files, found 124, missing hashes 3

# rkhunter --cronjob --report-warnings-only
Warning: No hash value found for file '/usr/bin/less' in the rkhunter.dat file.
Warning: No hash value found for file '/usr/bin/lynx' in the rkhunter.dat file.
Warning: No hash value found for file '/usr/bin/pstree' in the rkhunter.dat file.

# grep /less /var/log/rkhunter.log
[12:26:32] /usr/bin/less [ Warning ]
[12:26:32] Warning: No hash value found for file '/usr/bin/less' in the
rkhunter.dat file.

# grep /less /var/lib/rkhunter/db/rkhunter.dat
File:/usr/bin/less::594466:0755:0:0:101788:1158143116:

Can you please tell me what I'm doing wrong.

Thank you and a very Merry Christmas to you all :-)

Dan

[u***@hushmail.com]

Hello Dogsbody,

Post by Dogsbody
After upgrading my operating system (CentOS 4.5 to 4.6) I am
getting some errors
I don't quite understand. After upgrading I did a --propupd.
# rkhunter --propupd
[ Rootkit Hunter version 1.3.0 ]
File updated: searched for 147 files, found 124, missing hashes 3
# grep /less /var/lib/rkhunter/db/rkhunter.dat
Can you please tell me what I'm doing wrong.

Hmm. Well, maybe you're not doing anything wrong. What does 'file
/usr/bin/less' say?

Post by Dogsbody
Thank you and a very Merry Christmas to you all :-)

I'll wish you all a happy New Year!



--
Fashion Design Education - Click Here!
http://tagline.hushmail.com/fc/Ioyw6h4fN1KaBo2BpKIHITmfCeiZpsqVORD4XIrMht1uOMz4fyhqUY/
Cheers, unSpawn

[Larry]

Post by u***@hushmail.com
Hmm. Well, maybe you're not doing anything wrong. What does 'file
/usr/bin/less' say?

I am having this problem too .. tried all the 'options' resolving it
would be nice so I do not get the compromised message each morning.

***@uss [~]# file /usr/bin/less
/usr/bin/less: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
for GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped
***@uss [~]# file /usr/bin/lynx
/usr/bin/lynx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
for GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped
***@uss [~]# file /usr/bin/pstree
/usr/bin/pstree: ELF 32-bit LSB executable, Intel 80386, version 1
(SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs ),
stripped


Thanks,
Larry

[Dogsbody]

Post by u***@hushmail.com

Post by Dogsbody
# rkhunter --propupd
[ Rootkit Hunter version 1.3.0 ]
File updated: searched for 147 files, found 124, missing hashes 3
# grep /less /var/lib/rkhunter/db/rkhunter.dat
Can you please tell me what I'm doing wrong.

Hmm. Well, maybe you're not doing anything wrong. What does 'file
/usr/bin/less' say?

Well I'm glad it's not just me :-)

# file /usr/bin/less
/usr/bin/less: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for
GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped

Please let me know if there is anything else I can do to help.

Dan

[Helmut Hullen]

Hallo, Dogsbody,

Post by Dogsbody
After upgrading my operating system (CentOS 4.5 to 4.6) I am getting
some errors I don't quite understand. After upgrading I did a
--propupd.
# rkhunter --propupd
[ Rootkit Hunter version 1.3.0 ]
File updated: searched for 147 files, found 124, missing hashes 3
# rkhunter --cronjob --report-warnings-only
Warning: No hash value found for file '/usr/bin/less' in the
rkhunter.dat file.

/var/lib/rkhunter/db/rkhunter.dat

There you should find an entry for "less" (among many other entrys). It
should be a new file (produced by "rkhunter --propupd").

What tells

which -a less

locate bin/less | grep less$

Viele Gruesse!
Helmut

[Larry]

Post by Dogsbody
/var/lib/rkhunter/db/rkhunter.dat
There you should find an entry for "less" (among many other entrys). It
should be a new file (produced by "rkhunter --propupd").

/usr/local/rkhunter/lib/rkhunter/db/rkhunter.dat is where I found mine,
all of the ones RKHunter is whinging about are listed without hashes and
show the correct path!

Larry

[Dogsbody]

Hi Helmut,

Post by Dogsbody
/var/lib/rkhunter/db/rkhunter.dat
There you should find an entry for "less" (among many other entrys). It
should be a new file (produced by "rkhunter --propupd").

Yes, as Larry says, this file seems to get updated except for the hashes for
these three files, it's all very strange.

# grep /less /var/lib/rkhunter/db/rkhunter.dat

Post by Dogsbody
What tells
which -a less
locate bin/less | grep less$

# which -a less
/usr/bin/less
# locate bin/less | grep less$
/usr/bin/less

Dan

[Helmut Hullen]

Hallo, Larry,

Post by Larry

Post by Dogsbody
/var/lib/rkhunter/db/rkhunter.dat
There you should find an entry for "less" (among many other entrys).
It should be a new file (produced by "rkhunter --propupd").

/usr/local/rkhunter/lib/rkhunter/db/rkhunter.dat is where I found
mine, all of the ones RKHunter is whinging about are listed without
hashes and show the correct path!

Strange.
Should be:
File:/usr/bin/less:<hash>:<some1>:rights:owner:group:length:<some2>

Viele Gruesse!
Helmut

[Helmut Hullen]

Hallo, Dogsbody,

Post by Dogsbody

Post by Helmut Hullen
There you should find an entry for "less" (among many other entrys).
It should be a new file (produced by "rkhunter --propupd").

Yes, as Larry says, this file seems to get updated except for the
hashes for these three files, it's all very strange.

Just to make you nervous: can you put clean files into your computer
(via a live CD)?
Perhaps for the md5sum job too.

Post by Dogsbody
# which -a less
/usr/bin/less
# locate bin/less | grep less$
/usr/bin/less

Ok - no second file.

Viele Gruesse!
Helmut

[Dogsbody]

Post by Helmut Hullen
Just to make you nervous: can you put clean files into your computer
(via a live CD)?
Perhaps for the md5sum job too.

I can't easily do that as these are production machines.

I'd like to say that this is unlikely as this has now happened to all of my
machines at different times (some are not even connected to the internet)
however it has happened to them all after they were upgraded from CentOS 4.5 to
CentOS 4.6 (via yum).

Dan

P.S. log sent to unspawn and John as requested.

[u***@hushmail.com]

Post by Dogsbody
# grep /less /var/lib/rkhunter/db/rkhunter.dat

Dan, could please you *gzip*, attach and send the log
(/tmp/rkhunter-debug) from running 'rkhunter --debug --propupd' to
me and John?



--
Reconnect with your classmates. Click here for information on your classmate reunion.
http://tagline.hushmail.com/fc/Ioyw6h4fIDWskZcc2TRuDMuHpQ6yzIGQ9L1gVvDy2fgfmUlPgful5u/
TIA, unSpawn

[John Horne]

Post by Dogsbody
Hi,
After upgrading my operating system (CentOS 4.5 to 4.6) I am getting some errors
I don't quite understand. After upgrading I did a --propupd.
# rkhunter --propupd
[ Rootkit Hunter version 1.3.0 ]
File updated: searched for 147 files, found 124, missing hashes 3
# rkhunter --cronjob --report-warnings-only
Warning: No hash value found for file '/usr/bin/less' in the rkhunter.dat file.
Warning: No hash value found for file '/usr/bin/lynx' in the rkhunter.dat file.
Warning: No hash value found for file '/usr/bin/pstree' in the rkhunter.dat file.
# grep /less /var/log/rkhunter.log
[12:26:32] /usr/bin/less [ Warning ]
[12:26:32] Warning: No hash value found for file '/usr/bin/less' in the
rkhunter.dat file.

It's a known problem caused by prelinking
(https://bugzilla.redhat.com/show_bug.cgi?id=240658). The rkhunter.dat
file will have entries for these commands, but as the message says no
*hash* entry. If you run something like 'prelink /usr/bin/less' you will
get an error. This is what RKH sees.

The FAQ file also mentions about the 'missing hashes' error.



John.

[Larry]

Post by John Horne
It's a known problem caused by prelinking

OK .. but how can we fix/get around this in RKHunter?

A mentioned before I have it setup in cron so it only mails me if it
detects a problem, so I would like to stop it reporting this issue.

Thanks,
Larry

[John Horne]

Post by Larry

Post by John Horne
It's a known problem caused by prelinking

OK .. but how can we fix/get around this in RKHunter?

The only way I can think of is if you use the RPM package manager.
Running 'rpm -Vf /usr/bin/less' it should give no error (it will show no
output at all). If you set the PKGMGR option in rkhunter.conf, then run
'rkhunter --propupd' afterwards.


John.

[John Horne]

Post by John Horne

Post by Larry

Post by John Horne
It's a known problem caused by prelinking

OK .. but how can we fix/get around this in RKHunter?

The only way I can think of is if you use the RPM package manager.
Running 'rpm -Vf /usr/bin/less' it should give no error (it will show no
output at all). If you set the PKGMGR option in rkhunter.conf, then run
'rkhunter --propupd' afterwards.

Doh! No that won't work, rpm verification uses prelinking itself. I
suspect the only possible way would be to disable the 'hashes' test
completely. I can think of no other way of avoiding the problem. I'll
look in to some method that could be used for the next release.



John.

[Dogsbody]

Post by John Horne

Post by John Horne

Post by Larry

Post by John Horne
It's a known problem caused by prelinking

OK .. but how can we fix/get around this in RKHunter?

The only way I can think of is if you use the RPM package manager.
Running 'rpm -Vf /usr/bin/less' it should give no error (it will show no
output at all). If you set the PKGMGR option in rkhunter.conf, then run
'rkhunter --propupd' afterwards.

Doh! No that won't work, rpm verification uses prelinking itself. I
suspect the only possible way would be to disable the 'hashes' test
completely. I can think of no other way of avoiding the problem. I'll
look in to some method that could be used for the next release.

I have just been playing around with removing the relevant three lines from the
rkhunter.dat file but that didn't work.

The only way I have found so far is to remove the three files from
"PROP_FILE_LIST" in "/usr/local/bin/rkhunter".

Dan

[Dogsbody]

Post by John Horne
It's a known problem caused by prelinking
(https://bugzilla.redhat.com/show_bug.cgi?id=240658). The rkhunter.dat
file will have entries for these commands, but as the message says no
*hash* entry. If you run something like 'prelink /usr/bin/less' you will
get an error. This is what RKH sees.

Ahh, OK, thank you. Is there any way to exclude these binaries that give
errors? I had a look through the /etc/rkhunter.conf file but couldn't find
anything, perhaps remove the lines from rkhunter.dat?

Post by John Horne
The FAQ file also mentions about the 'missing hashes' error.

Was I looking in the wrong place then? I went to the Rootkit Hunter homepage
[1] and clicked through to the FAQ [2] but couldn't even find the word "missing".

Thanks again

Dan

[1] http://rkhunter.sourceforge.net/
[2] http://sourceforge.net/docman/display_doc.php?docid=35179&group_id=155034

[Nils Breunese (Lemonbit)]

Post by Dogsbody

Post by John Horne
It's a known problem caused by prelinking
(https://bugzilla.redhat.com/show_bug.cgi?id=240658). The
rkhunter.dat
file will have entries for these commands, but as the message says no
*hash* entry. If you run something like 'prelink /usr/bin/less' you will
get an error. This is what RKH sees.

Ahh, OK, thank you. Is there any way to exclude these binaries that give
errors? I had a look through the /etc/rkhunter.conf file but
couldn't find
anything, perhaps remove the lines from rkhunter.dat?

Post by John Horne
The FAQ file also mentions about the 'missing hashes' error.

Was I looking in the wrong place then? I went to the Rootkit Hunter homepage
[1] and clicked through to the FAQ [2] but couldn't even find the word "missing".

Als the FAQ recommends running hashupd.sh, while the RKH homepage
mentions the --propupd option replaces the hashupd.sh script.

Nils Breunese.

[John Horne]

Post by Nils Breunese (Lemonbit)

Post by Dogsbody

Post by John Horne
It's a known problem caused by prelinking
(https://bugzilla.redhat.com/show_bug.cgi?id=240658). The
rkhunter.dat
file will have entries for these commands, but as the message says no
*hash* entry. If you run something like 'prelink /usr/bin/less' you will
get an error. This is what RKH sees.

Ahh, OK, thank you. Is there any way to exclude these binaries that give
errors? I had a look through the /etc/rkhunter.conf file but couldn't find
anything, perhaps remove the lines from rkhunter.dat?

Post by John Horne
The FAQ file also mentions about the 'missing hashes' error.

Was I looking in the wrong place then? I went to the Rootkit Hunter homepage
[1] and clicked through to the FAQ [2] but couldn't even find the word "missing".

Als the FAQ recommends running hashupd.sh, while the RKH homepage
mentions the --propupd option replaces the hashupd.sh script.

I suspect the online FAQ is out of date. You need to look at the FAQ
supplied with the RKH tarball (or however it was installed on your
systems).


John.

[Dogsbody]

Post by John Horne

Post by Nils Breunese (Lemonbit)

Post by Dogsbody

Post by John Horne

Post by Dogsbody

Post by John Horne
It's a known problem caused by prelinking
(https://bugzilla.redhat.com/show_bug.cgi?id=240658). The rkhunter.dat
file will have entries for these commands, but as the message says no
*hash* entry. If you run something like 'prelink /usr/bin/less' you
will get an error. This is what RKH sees.

Ahh, OK, thank you. Is there any way to exclude these binaries that
give errors? I had a look through the /etc/rkhunter.conf file but
couldn't find anything, perhaps remove the lines from rkhunter.dat?

The FAQ file also mentions about the 'missing hashes' error.

Was I looking in the wrong place then? I went to the Rootkit Hunter
homepage and clicked through to the FAQ but couldn't even find the
word "missing".

Als the FAQ recommends running hashupd.sh, while the RKH homepage
mentions the --propupd option replaces the hashupd.sh script.

I suspect the online FAQ is out of date. You need to look at the FAQ
supplied with the RKH tarball (or however it was installed on your
systems).

Hi,

With the release of 1.3.2 is it possible to whitelist these files or do I have
to hack /usr/local/bin/rkhunter again to delete the entries to these three files?

Great work on 1.3.2 though, thank you so much for all your hard work.

Dan

[John Horne]

Post by Dogsbody
With the release of 1.3.2 is it possible to whitelist these files or do I have
to hack /usr/local/bin/rkhunter again to delete the entries to these three files?

Sorry but whitelisting is still not possible with 1.3.2. It is on my
todo list, but I have just had so much other (non-RKH) stuff to do that
it has not progressed very far.



John.

[Dogsbody]

Post by John Horne

Post by Dogsbody
With the release of 1.3.2 is it possible to whitelist these files or do I have
to hack /usr/local/bin/rkhunter again to delete the entries to these three files?

Sorry but whitelisting is still not possible with 1.3.2. It is on my
todo list, but I have just had so much other (non-RKH) stuff to do that
it has not progressed very far.

No worries, thanks for keeping it on the radar :-)

Take care

Dan

[Dogsbody]

Post by Dogsbody

Post by John Horne

Post by Dogsbody
With the release of 1.3.2 is it possible to whitelist these files or
do I have to hack /usr/local/bin/rkhunter again to delete the entries
to these three files?

Sorry but whitelisting is still not possible with 1.3.2. It is on my
todo list, but I have just had so much other (non-RKH) stuff to do that
it has not progressed very far.

No worries, thanks for keeping it on the radar :-)

Can I please find out if this has been implemented in v1.3.4? I did
look but couldn't find anything.

I have v1.3.4 up and running and it works great, thank you for a great
tool :-)

Take care

Dan

[John Horne]

Post by Dogsbody

Post by Dogsbody

Post by John Horne

Post by Dogsbody
With the release of 1.3.2 is it possible to whitelist these files or
do I have to hack /usr/local/bin/rkhunter again to delete the entries
to these three files?

Sorry but whitelisting is still not possible with 1.3.2. It is on my
todo list, but I have just had so much other (non-RKH) stuff to do that
it has not progressed very far.

No worries, thanks for keeping it on the radar :-)

Can I please find out if this has been implemented in v1.3.4? I did
look but couldn't find anything.

No it hasn't been implemented. I cannot do it until I have fixed another
part of RKH, and I cannot do that bit because at the moment I'm having
some problems with it. (It's not an easy problem and is taking much
longer than I anticipated.)

Are you still getting persistent prelink errors? I have not had these
for a very long time, and usually found that simply running 'prelink
<filename>' resolves any prelink problem.




John.

[Dogsbody]

Hi John,

Post by John Horne
No it hasn't been implemented. I cannot do it until I have fixed another
part of RKH, and I cannot do that bit because at the moment I'm having
some problems with it. (It's not an easy problem and is taking much
longer than I anticipated.)

No worries at all, I just wanted to make sure I wasn't missing something
myself :-)

Post by John Horne
Are you still getting persistent prelink errors? I have not had these
for a very long time, and usually found that simply running 'prelink
<filename>' resolves any prelink problem.

Unfortunately so, It only happens on two binaries now but this is on all
my fully patched/updated CentOS 4.x boxes

# prelink /usr/bin/less
prelink: /usr/lib/libncursesw.so.5.4: .debug_loc adjusting unfinished
# prelink /usr/bin/pstree
prelink: /usr/lib/libncurses.so.5.4: .debug_loc adjusting unfinished

I don't think it's a huge problem.

Dan

[Nils Breunese (Lemonbit)]

Post by Dogsbody

Post by John Horne
Are you still getting persistent prelink errors? I have not had these
for a very long time, and usually found that simply running 'prelink
<filename>' resolves any prelink problem.

Unfortunately so, It only happens on two binaries now but this is on all
my fully patched/updated CentOS 4.x boxes
# prelink /usr/bin/less
prelink: /usr/lib/libncursesw.so.5.4: .debug_loc adjusting unfinished
# prelink /usr/bin/pstree
prelink: /usr/lib/libncurses.so.5.4: .debug_loc adjusting unfinished
I don't think it's a huge problem.

That seems to be a RHEL prelink bug: https://bugzilla.redhat.com/show_bug.cgi?id=240658

Nils Breunese.

[Dogsbody]

Post by Nils Breunese (Lemonbit)

Post by Dogsbody
Unfortunately so, It only happens on two binaries now but this is on
all my fully patched/updated CentOS 4.x boxes
# prelink /usr/bin/less
prelink: /usr/lib/libncursesw.so.5.4: .debug_loc adjusting unfinished
# prelink /usr/bin/pstree
prelink: /usr/lib/libncurses.so.5.4: .debug_loc adjusting unfinished
I don't think it's a huge problem.

That seems to be a RHEL prelink bug: https://bugzilla.redhat.com/show_bug.cgi?id=240658

That's the one! You would have thought they would have fixed it by now
:-p I'm not complaining though as I don't pay them any money :-)

Dan

[John Horne]

Post by Dogsbody

Post by Nils Breunese (Lemonbit)

Post by Dogsbody
Unfortunately so, It only happens on two binaries now but this is on
all my fully patched/updated CentOS 4.x boxes
# prelink /usr/bin/less
prelink: /usr/lib/libncursesw.so.5.4: .debug_loc adjusting unfinished
# prelink /usr/bin/pstree
prelink: /usr/lib/libncurses.so.5.4: .debug_loc adjusting unfinished
I don't think it's a huge problem.

That seems to be a RHEL prelink bug: https://bugzilla.redhat.com/show_bug.cgi?id=240658

That's the one! You would have thought they would have fixed it by now
:-p I'm not complaining though as I don't pay them any money :-)

No, but we (my employers) do :-) Having said that though, this problem
does not exist at RHEL 4.7. Which is why I asked if you were still
having the problem. I don't see why CentOS should fail, but RHEL works
fine. Actually I don't see this problem on any RHEL 3 or 4 servers, nor
on CentOS 5.2.

As an aside issue, could you run rkhunter with debugging enabled please:
rkhunter --debug --enable properties

and email me the resultant file. It should start
with /tmp/rkhunter-debug, but will have random numbers/letters appended
to the name. I have been thinking more about the problem, and would like
to see exactly where it fails. Thanks.




John.

[Dogsbody]

Post by John Horne

Post by Dogsbody

Post by Nils Breunese (Lemonbit)
That seems to be a RHEL prelink bug: https://bugzilla.redhat.com/show_bug.cgi?id=240658

That's the one! You would have thought they would have fixed it by now
:-p I'm not complaining though as I don't pay them any money :-)

No, but we (my employers) do :-) Having said that though, this problem
does not exist at RHEL 4.7. Which is why I asked if you were still
having the problem. I don't see why CentOS should fail, but RHEL works
fine. Actually I don't see this problem on any RHEL 3 or 4 servers, nor
on CentOS 5.2.

That is a bit strange! Reading up on some of the issues with this
prelinking bug it certainly seems to be a little hit and miss.

Post by John Horne
rkhunter --debug --enable properties
and email me the resultant file. It should start
with /tmp/rkhunter-debug, but will have random numbers/letters appended
to the name. I have been thinking more about the problem, and would like
to see exactly where it fails. Thanks.

Sure, will send it to you off list :-)

Dan

[Nils Breunese (Lemonbit)]

Post by John Horne

Post by Dogsbody

Post by Nils Breunese (Lemonbit)

Post by Dogsbody
Unfortunately so, It only happens on two binaries now but this is on
all my fully patched/updated CentOS 4.x boxes
# prelink /usr/bin/less
prelink: /usr/lib/libncursesw.so.5.4: .debug_loc adjusting
unfinished
# prelink /usr/bin/pstree
prelink: /usr/lib/libncurses.so.5.4: .debug_loc adjusting
unfinished
I don't think it's a huge problem.

That seems to be a RHEL prelink bug: https://bugzilla.redhat.com/show_bug.cgi?id=240658

That's the one! You would have thought they would have fixed it by now
:-p I'm not complaining though as I don't pay them any money :-)

No, but we (my employers) do :-) Having said that though, this problem
does not exist at RHEL 4.7. Which is why I asked if you were still
having the problem. I don't see why CentOS should fail, but RHEL works
fine. Actually I don't see this problem on any RHEL 3 or 4 servers, nor
on CentOS 5.2.

I have seen this problem too on several of our CentOS servers.

Nils Breunese.