RKHunter

[shamcs]

hye there...

just want to ask..i finally get my server reformat and replace with redhat server v 5.5 ...

so my last problem was here www dot linuxforums dot org/forum/red-hat-fedora-linux/170847-what-processing.html

and the same thing show in rkhunter log..

like this

"
[18:00:36] /sbin/ifdown [ Warning ]
[18:00:36] Warning: The command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: Bourne-Again shell script text executable
[18:00:36] /sbin/ifup [ Warning ]
[18:00:36] Warning: The command '/sbin/ifup' has been replaced by a script: /sbin/ifup: Bourne-Again shell script text executable
[18:00:32] /usr/bin/whatis [ Warning ]
[18:00:32] Warning: The command '/usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable
[18:00:17] /usr/bin/ldd [ Warning ]
[18:00:17] Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne shell script text executable
[18:00:14] /usr/bin/GET [ Warning ]
[18:00:14] Warning: The command '/usr/bin/GET' has been replaced by a script: /usr/bin/GET: perl script text executable
[18:00:14] /usr/bin/groups [ Warning ]
[18:00:15] Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: Bourne shell script text executable

"
:
:
:

any idea..is it false positive by scanning using rkhunter...??

[Irithori]

hmm,
open the files with less or use file on them.

If they are indeed shell scripts, then either your install dvd is somehow corrupted
or redhat indeed uses shell wrappers for these binaries.
Which would be very weird, as the centos 5.5 I have at hand (which is almost 100% identical to redhat) does have binaries there:

file /sbin/ifconfig 
/sbin/ifconfig: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped

[shamcs]

hye Irithori..

i did search google on this topic..and i found this on the forum..

see here www dot webhostingtalk dot com/showthread.php?t=639921

so is it false detect by rkhunter..??sigh..