Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is my rkhunter output that I recently set so I get this report every morning, could somone please explain if I have a serious problem here (I know about httpd, openssl, php and sshd not up to date, but all other commands I don't understand - did I have a breach and someone replaced their file with their own - for example '/usr/bin/whatis')

Warning: Checking for prerequisites               [ Warning ]
    The file of stored file properties (rkhunter.dat) does not exist, and should be created. To do this type in 'rkhunter --propupd'.
Warning: WARNING! It is the users responsibility to ensure that when the '--propupd' option
    is used, all the files on their system are known to be genuine, and installed from a
    reliable source. The rkhunter '--check' option will compare the current file properties
    against previously stored values, and report if any values differ. However, rkhunter
    cannot determine what has caused the change, that is for the user to do.
Warning: The command '/usr/bin/GET' has been replaced by a script: /usr/bin/GET: perl script text executable
Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: Bourne shell script text executable
Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne     shell script text executable
Warning: The command '/usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable
Warning: The command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: Bourne-Again shell script text executable
Warning: The command '/sbin/ifup' has been replaced by a script: /sbin/ifup: Bourne-Again shell script text executable
Warning: Found enabled xinetd service: /etc/xinetd.d/ftp_psa
Warning: Found enabled xinetd service: /etc/xinetd.d/poppassd_psa
Warning: No output found from the lsmod command or the /proc/modules file:
    /proc/modules output:
    lsmod output:
Warning: The kernel modules directory '/lib/modules' is missing or empty.
Warning: User 'hengifts-new' has been removed from the passwd file.
Warning: Hidden directory found: /dev/.udev
Warning: Hidden file found: /usr/share/man/man1/..1.gz: gzip compressed data, from Unix, max compression
Warning: Hidden file found: /usr/bin/.ssh.hmac: ASCII text
Warning: Hidden file found: /usr/bin/.fipscheck.hmac: ASCII text
Warning: Hidden file found: /usr/sbin/.sshd.hmac: ASCII text
Warning: Application 'httpd', version '2.2.3', is out of date, and possibly a security risk.
Warning: Application 'openssl', version '0.9.8e', is out of date, and possibly a security risk.
Warning: Application 'php', version '5.2.10', is out of date, and possibly a security risk.
Warning: Application 'sshd', version '4.3p2', is out of date, and possibly a security risk.
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Seems to me you're not using a rkhunter that is supplied from your distribution, but rather downloaded (the latest?) and installed it yourself, and because a lot of the distribution specifics has not been whitelisted these warnings are generated.

Oh, I used google.com btw.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.