rkhunter is warning that files such as /usr/bin/top and /usr/bin/vmstat have changed, including their hashes. I don't recall installing updates recently. Does this point to a rootkit, and what should I check?
Why is rkhunter warning that system files changed?
Asked by
~next.page+maybe
Answers
A changed hash means the file no longer matches rkhunter's stored baseline. It doesn't tell you why it changed. A package update can cause this, but so can an unwanted modification.
On an Arch-based system, run pacman -Qo /usr/bin/top to find the package that owns it. Then run pacman -Qkk followed by that package name to check its installed files. Do the same for the other warnings and compare the package history with the time of the changes.
Reply to this answer
Those utilities can belong to the same package, so one package update may explain several warnings at once. Check the package manager's log even if you don't remember updating. Also check whether an automated update ran.
Reply to this answer
Don't rush to reset the rkhunter database just to make the warnings go away. Once you've verified that the changes are expected, rkhunter --propupd updates its stored file properties. Running it before checking would make the current files the new baseline, including any you haven't explained.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions