RKHunter Bad Hashes Error Message

R

rohit

Verified User
Joined
Mar 20, 2007
Messages
198
Location
Melbourne
Hi,

Did you find a solution for this. I installed RkHunter and it is giving error on Bad Hashes

/bin/cat [ BAD ]
/bin/chmod [ BAD ]
/bin/chown [ BAD ]
/bin/date [ BAD ]
/bin/dmesg [ BAD ]
/bin/env [ BAD ]
/bin/grep [ OK ]
/bin/kill [ BAD ]
/bin/login [ BAD ]
/bin/ls [ BAD ]
/bin/more [ BAD ]
/bin/mount [ BAD ]
/bin/netstat [ OK ]
/bin/ps [ OK ]
/bin/su [ BAD ]
/sbin/chkconfig [ OK ]
/sbin/depmod [ OK ]
/sbin/ifconfig [ OK ]
/sbin/init [ OK ]
/sbin/insmod [ OK ]
/sbin/ip [ OK ]
/sbin/modinfo [ OK ]
/sbin/runlevel [ OK ]
/sbin/sulogin [ OK ]
/sbin/sysctl [ OK ]
/sbin/syslogd [ OK ]
/usr/bin/chattr [ OK ]
/usr/bin/du [ BAD ]
/usr/bin/file [ OK ]
/usr/bin/find [ OK ]
/usr/bin/head [ BAD ]
/usr/bin/kill [ BAD ]
/usr/bin/killall [ OK ]
/usr/bin/lsattr [ OK ]
/usr/bin/md5sum [ BAD ]
/usr/bin/passwd [ OK ]
/usr/bin/pstree [ OK ]
/usr/bin/sha1sum [ BAD ]
/usr/bin/slocate [ OK ]
/usr/bin/stat [ BAD ]
/usr/bin/strings [ OK ]
/usr/bin/top [ OK ]
/usr/bin/users [ BAD ]
/usr/bin/vmstat [ OK ]
/usr/bin/w [ OK ]
/usr/bin/watch [ OK ]
/usr/bin/wc [ BAD ]
/usr/bin/wget [ OK ]
/usr/bin/whereis [ BAD ]
/usr/bin/who [ BAD ]
/usr/bin/whoami [ BAD ]
/usr/sbin/xinetd [ OK ]

Is it something really BAD for the box? Where does RKHUnter gets the hashes.

Most of them are linked to coreutils-4.5.3-28.1 and util-linux-2.11y-31.18

I found that /usr/local/rkhunter/lib/rkhunter/db/defaulthashes.dat contains the hash values for a specific distribution e.g for RedHat Enterprise the OS ID is 722.

Do we know that from where rkhunter gets the values for these hashes?

The version number of Redhat on the box is 2.4.21-47.ELsmp

You think the reason I am getting these errors is because of the New Released Version of Redhat Enterprise Edition

On the another server where I am running coreutils-4.5.3-28, I dont see any errors from rkhunter.

Any help would be really appreciated.
 
Last edited:
Did you just install RKHunter? Or is it an old install that worked before?

Documentation for RKHunter may be found here.

Jeff
 
I have just installed rkhundter and don't see that information on my server.

What version of rkhunter you have? And how do you run it? I will check on my server.
 
Hi Jeff,

Yes, I installed it last week and that's when I found out about this issue.

The version of rkhunter I am running is latest 1.2.9

I run rkhunter using a cron process everyday in the morning

I also run chkrootkit and it doesn't complain abt anything??

Thanks in advance

Rohit
 
Hi Guys,

I have upgraded my versions of coreutils-4.5.3-28.1 and util-linux-2.11y-31.18 to

coreutils-4.5.3-28.4 and util-linux-2.11y-31.19

and this is what I get

[root@server RPMS]# rpm -qf `which more`
util-linux-2.11y-31.19
Click to expand...

[root@server RPMS]# rpm -qf `which cat`
coreutils-4.5.3-28.4
Click to expand...

Rohit
 
i ran

rkhunter -c --createlogfile
Click to expand...

[19:50:38] ---------------------------- MD5 hash tests ---------------------------
[19:50:38] Starting MD5 checksum test (/usr/local/rkhunter/lib/rkhunter/scripts/filehashmd5.pl)
[19:50:38] /bin/cat Hash NOT valid (My MD5: c5953b025c1e9e3e7b6c14755d53093d, expected: 2a8b71a3501fe4d4c15db2b11c3c694b)
[19:50:38] Using whitelists to compare MD5 hash (searching for c5953b025c1e9e3e7b6c14755d53093d)
[19:50:38] No whitelisted MD5 hash found for /bin/cat
[19:50:38] MD5 hash for my file (/bin/cat) is c5953b025c1e9e3e7b6c14755d53093d, but is not in database
[19:50:38] End of whitelist compare
[19:50:38] Checking /bin/cat against hashes in database (2a8b71a3501fe4d4c15db2b11c3c694b) failed
[19:50:39] RPM info: your package 'coreutils-4.5.3-28.4'
[19:50:39] RPM info: packages in database:
[19:50:39] ---
[19:50:39] 722:/bin/cat:c5953b025c1e9e3e7b6c14755d53093d:-:-:coreutils-4.5.3-28.4
[19:50:39] ---


[19:50:39] /bin/dmesg Hash NOT valid (My MD5: 6608ea1ebe87a3948156528d5a96ee60, expected: fd9e9d463711ba3ae35aafcc9b0e3a77)
[19:50:39] Using whitelists to compare MD5 hash (searching for 6608ea1ebe87a3948156528d5a96ee60)
[19:50:39] No whitelisted MD5 hash found for /bin/dmesg
[19:50:39] MD5 hash for my file (/bin/dmesg) is 6608ea1ebe87a3948156528d5a96ee60, but is not in database
[19:50:39] End of whitelist compare
[19:50:39] Checking /bin/dmesg against hashes in database (fd9e9d463711ba3ae35aafcc9b0e3a77) failed
[19:50:39] RPM info: your package 'util-linux-2.11y-31.19'
[19:50:39] RPM info: packages in database:
[19:50:39] ---
[19:50:39] 722:/bin/dmesg:6608ea1ebe87a3948156528d5a96ee60:-:-:util-linux-2.11y-31.19
[19:50:39] ---



BUT i still get these errors. You think if it is false positive?
 
It could be a false positive. Have you googled for help? Have you asked anyone who works with rkhunter development?

Jeff
 
jeff, i have already posted a message to the Mailing List and haven't heard anything back from anyone yet. I have also posted a support ticket on sourceforge http://sourceforge.net/tracker/?atid=794188&group_id=155034&func=browse and still waiting on any response.

Google wasn't much of a help!!!!!!!!

I have also emailed JHORNE, the devleoper of rkhunter and waiting for his reply too.

I will inform you what I find.
 
Hi Guys,

Got it fixed.

as suggested download this http://sourceforge.net/project/showfiles.php?group_id=155034&package_id=200881

wget http://belnet.dl.sourceforge.net/sourceforge/rkhunter/hashupd.sh
chmod +x hashupd.sh
./hashupd.sh

it will update your hashes locally after that run rkhunter

This is the main bit that I was after. hashupd updates the hash values locally.


RESULT FROM rkhunter

---------------------------- Scan results ----------------------------

MD5 scan
Scanned files: 52
Incorrect MD5 checksums: 0

File scan
Scanned files: 342
Possible infected files: 0

It now doesn't complain about BAD Hashes anymore.
 
Good work, Rohit.

Did you upgrade your entire OS before you had the problem?

What OS Distribution are you using?

Thanks!

Jeff
 
Hi Jeff,

No I didn't upgrade the OS at all. This is what we were provided with from the hosting company

We are currently running

Red Hat Enterprise Linux ES release 3 (Taroon Update 8)

and

Red Hat Enterprise Linux ES release 3 (Taroon Update 6)
 
Last edited:
rohit said:
Hi Guys,

Got it fixed.

as suggested download this http://sourceforge.net/project/showfiles.php?group_id=155034&package_id=200881

wget http://belnet.dl.sourceforge.net/sourceforge/rkhunter/hashupd.sh
chmod +x hashupd.sh
./hashupd.sh

it will update your hashes locally after that run rkhunter
Click to expand...

Thanks, that did the trick :)
The url changed for me though, into:
http://garr.dl.sourceforge.net/sourceforge/rkhunter/hashupd.sh
And u'll need a bit of patience for the connection.
 
You must log in or register to reply here.
Back
Top