Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Ubuntu 10.04.4 LTS with fully update OS. The below messages is from rkhunter, What does it mean? Can anyone please explain.

Warning: The file properties have changed:
         File: /bin/sh
         Current hash: fbc463bc858e28f38229e0b4711a895ca8a24a8a
         Stored hash : 80018ad5dc87488c52033d95cbcbb740a8bc89b7
         Current inode: 105064    Stored inode: 261
         Current file modification time: 1362564093 (06-Mar-2013 15:31:33)
         Stored file modification time : 1331099647 (07-Mar-2012 11:24:07)
share|improve this question
Umm... so was /bin/sh one of the things you fully updated? – Michael Hampton Sep 5 '13 at 14:03

Yes, that you have a file property change on the file /bin/sh at 06 Mar 2013 and time 15:31:33. Someone changed the file properties.

Maybe an ls -l /bin/sh give you what have been changed at 06 Mar 2013. Also maybe the file properties changed due to an update that you have done.

share|improve this answer
Yes, that the file have been changed doesn't mean that its compromised. But you must check if it is this change due to an update or not. Then you will know. But in most case the most cause is due to an update/patch. – ankso Sep 5 '13 at 13:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.