Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I ran rkhunter and received the following warnings in its output:

$ rkhunter --update
$ rkhunter -c

...
...
...

Performing file properties checks
    /sbin/chkconfig                                          [ Warning ]

In the /var/log/rkhunter.log, it shows this message:

Warning: The command '/sbin/chkconfig' has been replaced by a script: /sbin/chkconfig: Perl script, ASCII text executable

Though I am on a Debian system and am aware of update-rc.d, I occasionally use chkconfig to configure services.

What does this warning mean? How serious is this?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

I would think that this warning is harmless (assuming you have not been hacked or you haven't installed any suspicious packages), it seems that rkhunter thinks that scripts in /sbin are suspicious behaviour.

In fact, checked on a clean Ubuntu install I have here and chkconfig is indeed a script.

share|improve this answer
    
You meant chkconfig is indeed a script as opposed to a binary, right? Just trying to understand here. What is the difference? –  Nanda Oct 24 '12 at 14:08
    
Exactly; type file /sbin/chkconfig and see for yourself. The main difference is that a script is (generally) written in an interpreted language (bash, perl etc...) and a binary is the result of compiling a program (e.g. written in C); from an end-user (not a developer) point of view, there isn't much difference. –  Renan Oct 24 '12 at 14:37
1  
Since /sbin is supposed to have binaries in it, rkhunter threw a warning since it encountered a script rather than an executable. It makes sense. –  Nanda Oct 24 '12 at 14:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.