Re: rkhunter warning wget

[Jens Schüßler <jgs@trash.net>]

* maex@firstfloor.org <maex@firstfloor.org> wrote:
> hello
> 
> after updateing wget on
> 
> Linux version 2.6.26-2-686 (Debian 2.6.26-19) Lenny
> 
> i received a waring from rkhunter:
> 
> Warning: The file properties have changed:
>          File: /usr/bin/wget
>          Current hash: 2d5d175c449eecfda43401a7a66b8a369859524d
>          Stored hash : 1725543768f7e1b2a32136ca1799213a8bdb886b
>          Current inode: 137892    Stored inode: 140983
>          Current size: 226292    Stored size: 226260
>          Current file modification time: 1255005510
>          Stored file modification time : 1220829421
> 
> 
> could this be serious?

It's normal that the hash change after an upgrade. 
Take a look at 
,----[ /usr/share/doc/rkhunter/README.Debian ]-
| * HASH CHECKS
|   By default, all hashes checks are now ENABLED in the standard daily cron
|   job.
| 
|   Add the 'hashes' and 'attributes' tests to the DISABLED_TESTS option in
|   /etc/rkhunter.conf if you wish to disable them.
| 
|   If enabled, each time a base package is upgraded, you will have to run:
|   'rkhunter --propupd' to update the file properties database located
|   in /var/lib/rkhunter/db/rkhunter.dat.
| 
|   This can be done automatically after each install/remove. Please run:
|     # dpkg-reconfigure rkhunter
|   to enable this feature.
| 
`----

HTH
Jens