<div dir="ltr">I activated the automatic rkhunter database updates after software updates and executed sudo rkhunter --propupd again.</div><div class="gmail_extra"> <div class="gmail_quote">On Wed, Feb 24, 2016 at 11:27 PM, Bernie Innocenti <<a href="mailto:bernie@codewiz.org" target="_blank">bernie@codewiz.org</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 02/24/2016 11:43 AM, Samuel Cantero wrote: > I guess we should keep it and for me the current setup for checking once > a day is fine. It was working pretty well before the system upgrade. That's just because 10.04 was no longer getting any updates :-) > What do you think about to add APT_AUTOGEN="yes" to > /etc/default/rkhunter in order to enable automatic rkhunter database > updates after software updates? That's _exactly_ what I wanted :-) > Have we already executed sudo rkhunter --propupd since the last update? Yes, I did it a couple of times already. > Currently we are using the 1.4.0 version. The last one available is > 1.4.2. We could also update it. If it's packaged in a later version of ubuntu, we can probably get the binary package. Small scripts tend to work across different distro versions without much trouble. > On Wed, Feb 24, 2016 at 4:08 AM, Bernie Innocenti <<a href="mailto:bernie@codewiz.org">bernie@codewiz.org</a> > <mailto:<a href="mailto:bernie@codewiz.org">bernie@codewiz.org</a>>> wrote: > > Hmpf... rkhunter needs to be updated regularly or it will keep > moaning daily. > > Do we want to make it run less often or should I disable it? > > > On February 23, 2016 10:32:13 PM PST, <a href="mailto:root@sugarlabs.org">root@sugarlabs.org</a> <div><div class="h5">> <mailto:<a href="mailto:root@sugarlabs.org">root@sugarlabs.org</a>> wrote: > > Warning: The O/S name or version has changed since the last run: > Old O/S value: Ubuntu 14.04.3 LTS New value: Ubuntu 14.04.4 LTS > Because of the change(s) the file properties checks may give > some false-positive results. > You may need to re-run rkhunter with the '--propupd' option. > Warning: WARNING! It is the users responsibility to ensure that > when the '--propupd' option > is used, all the files on their system are known to be genuine, > and installed from a > reliable source. The rkhunter '--check' option will compare the > current file properties > against previously stored values, and report if any values > differ. However, rkhunter > cannot determine what has caused the change, that is for the > user to do. > Warning: The file properties have changed: > File: /sbin/sulogin > Current hash: 6de810ad6fa4ba62ddb61b8d8ca373796c39837f > Stored hash : 65190e4215cc434e4405ab06902cd4157981e445 > Current inode: 2515049 Stored inode: 2515007 > Current file modification time: 1455685146 (16-Feb-2016 23:59:06) > Stored file modification time : 1434339069 (14-Jun-2015 23:31:09) > Warning: The file properties have changed: > File: /usr/bin/last > Current hash: 01b54671ca1769b31a22a0a7b273d25e50fbcedb > Stored hash : fe1465ac9bee6592dbc088a0a437337f2e932ef4 > Current inode: 1311229 Stored inode: 1311646 > Current file modification time: 1455685146 (16-Feb-2016 23:59:06) > Stored file modification time : 1434339069 (14-Jun-2015 23:31:09) > Warning: The file properties have changed: > File: /usr/bin/ldd > Current hash: fef7edab0f0fc0889c3a4c4f415fa830c3b293a3 > Stored hash : e4bf03f0f5d7cff6d6b91822f3e101ff59b6bd06 > Current inode: 1311606 Stored inode: 1312373 > Current file modification time: 1455650774 (16-Feb-2016 14:26:14) > Stored file modification time : 1424883242 (25-Feb-2015 11:54:02) </div></div>> ------------------------------------------------------------------------ > > Systems-logs mailing list > <a href="mailto:Systems-logs@lists.sugarlabs.org">Systems-logs@lists.sugarlabs.org</a> > <mailto:<a href="mailto:Systems-logs@lists.sugarlabs.org">Systems-logs@lists.sugarlabs.org</a>> > <a href="http://lists.sugarlabs.org/listinfo/systems-logs" rel="noreferrer" target="_blank">http://lists.sugarlabs.org/listinfo/systems-logs</a> > > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > > _______________________________________________ > Systems mailing list > <a href="mailto:Systems@lists.sugarlabs.org">Systems@lists.sugarlabs.org</a> <mailto:<a href="mailto:Systems@lists.sugarlabs.org">Systems@lists.sugarlabs.org</a>> > <a href="http://lists.sugarlabs.org/listinfo/systems" rel="noreferrer" target="_blank">http://lists.sugarlabs.org/listinfo/systems</a> <div class="HOEnZb"><div class="h5">> > > > > _______________________________________________ > Systems mailing list > <a href="mailto:Systems@lists.sugarlabs.org">Systems@lists.sugarlabs.org</a> > <a href="http://lists.sugarlabs.org/listinfo/systems" rel="noreferrer" target="_blank">http://lists.sugarlabs.org/listinfo/systems</a> > </div></div>-- _ // Bernie Innocenti \X/ <a href="http://codewiz.org" rel="noreferrer" target="_blank">http://codewiz.org</a> </blockquote></div> </div>