Hi,
Running CPanel on a Centos 6 server for only a couple weeks, and pretty much from the start, RKHunter has been complaining that the permissions of /bin/su, /bin/mount and /usr/bin/newgrp don't match what the RPM DB says they should be. /bin/mount and /usr/bin/newgrp should be 4755, but the setuid bit has been removed. /bin/su should be 4755 and owned by group root, but it's 4750 and owned by group weel.
I saw no specific mention in the forums anywhere of CPanel making these changes, but I'm suspecting it did. Is this, in fact, true? If so, any suggestions on keeping RKHunter happy while still making it secure? --propupd does nothing for this since it's a package verification failure, and these are binaries that I'd really prefer not to whitelist. Personally, I'd like to set these perms and groups back to what they were in the original RPMs, but I'm not sure what that might break.
Any advice would be great.
Thanks,
Keith
Running CPanel on a Centos 6 server for only a couple weeks, and pretty much from the start, RKHunter has been complaining that the permissions of /bin/su, /bin/mount and /usr/bin/newgrp don't match what the RPM DB says they should be. /bin/mount and /usr/bin/newgrp should be 4755, but the setuid bit has been removed. /bin/su should be 4755 and owned by group root, but it's 4750 and owned by group weel.
I saw no specific mention in the forums anywhere of CPanel making these changes, but I'm suspecting it did. Is this, in fact, true? If so, any suggestions on keeping RKHunter happy while still making it secure? --propupd does nothing for this since it's a package verification failure, and these are binaries that I'd really prefer not to whitelist. Personally, I'd like to set these perms and groups back to what they were in the original RPMs, but I'm not sure what that might break.
Any advice would be great.
Thanks,
Keith