Hi list,
I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux
activated, Osiris (a decentralized scanner for files changes on distant
servers) signaled me several changes on files who were not (at first
sight) affected by a recent update (the list is below).
Is there a logic explanation for those changes to happen ? The "rpm
-Va"
command does not output md5sum change for those files.
compare time: Sat Aug 12 05:35:14 2006
host: server
scan config: server (abcdefg)
log file: no log file generated, see system log.
base database: 56
compare database: 57
[211][server][cmp][/usr/bin][mtime][Sun Aug 6 04:02:20 2006][Sat Aug 12
04:02:22 2006]
[213][server][cmp][/usr/bin][ctime][Sun Aug 6 04:02:20 2006][Sat Aug 12
04:02:22 2006]
[204][server][cmp][/usr/bin/afs5log][checksum][b838bb6106250fdfd95ae8a7dc7fa95b8f762df4][a4c817dd8ca12449dc1a8bdf7f972c19aa3ffd7b]
[206][server][cmp][/usr/bin/afs5log][inode][22423][22422]
[213][server][cmp][/usr/bin/afs5log][ctime][Thu Jun 29 21:43:54 2006][Sat Aug 12
04:02:22 2006]
[204][server][cmp][/usr/bin/dig][checksum][9d34eb65d61c9f43efc9b6141f727e7fdbb618bf][69d94a240e415b5f22a220fe71dcf865a9a5608c]
[206][server][cmp][/usr/bin/dig][inode][25755][25759]
[213][server][cmp][/usr/bin/dig][ctime][Thu Jun 29 21:43:48 2006][Sat Aug 12
04:02:21 2006]
[204][server][cmp][/usr/bin/elinks][checksum][a62ab203cc0126aa846419ca25e2e2a6524ab58d][a66553759b6392f20b4f4c61d798585636feea9e]
[206][server][cmp][/usr/bin/elinks][inode][26239][25433]
[213][server][cmp][/usr/bin/elinks][ctime][Thu Jul 27 04:02:16 2006][Sat Aug 12
04:02:22 2006]
[204][server][cmp][/usr/bin/host][checksum][f6e94925f133d1a9fe088da757ec60b493800adc][c47534726541474f7a1e1b7d23ec41ed44169118]
[206][server][cmp][/usr/bin/host][inode][25133][22958]
[213][server][cmp][/usr/bin/host][ctime][Thu Jun 29 21:43:51 2006][Sat Aug 12
04:02:21 2006]
[204][server][cmp][/usr/bin/ipmi_ui][checksum][e106a461a907d0dec9f622919ddaed1a84552063][1bb99621c20d3e66f362a355d8d8e09340f748d6]
[206][server][cmp][/usr/bin/ipmi_ui][inode][25973][21341]
[213][server][cmp][/usr/bin/ipmi_ui][ctime][Thu Jun 29 21:43:53 2006][Sat Aug 12
04:02:22 2006]
[204][server][cmp][/usr/bin/ipmish][checksum][f4f38f1f45f83d057b32deb2dbae9940f9d9dcc0][6e13d56f5457213de8302e08c311badcd49b1e46]
[206][server][cmp][/usr/bin/ipmish][inode][25042][25755]
[213][server][cmp][/usr/bin/ipmish][ctime][Thu Jun 29 21:43:50 2006][Sat Aug 12
04:02:21 2006]
[204][server][cmp][/usr/bin/nslookup][checksum][7f7087ace44e1d14e984cd367df3b794cc1859a3][655c9d0f1328aa07f45a061825989809ae5b9885]
[206][server][cmp][/usr/bin/nslookup][inode][25595][25317]
[213][server][cmp][/usr/bin/nslookup][ctime][Thu Jun 29 21:43:51 2006][Sat Aug
12 04:02:21 2006]
[204][server][cmp][/usr/bin/nsupdate][checksum][721695ed63aed8b55d6978b1384a0250d26d4d15][cac7585a8520d619d1a507b160e7a35651db3563]
[206][server][cmp][/usr/bin/nsupdate][inode][21341][25780]
[213][server][cmp][/usr/bin/nsupdate][ctime][Thu Jun 29 21:43:53 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/bin/openssl][checksum][c728d401456ee2003a329eb74e1ea3f008ddcf17][ddc4e323567fac0696dd9aeacea7402869837ff7]
[206][server][cmp][/usr/bin/openssl][inode][22379][22423]
[213][server][cmp][/usr/bin/openssl][ctime][Thu Jun 29 21:43:54 2006][Sat Aug 12
04:02:22 2006]
[211][server][cmp][/usr/sbin][mtime][Fri Jul 28 12:45:00 2006][Sat Aug 12
04:02:23 2006]
[213][server][cmp][/usr/sbin][ctime][Fri Jul 28 12:45:00 2006][Sat Aug 12
04:02:23 2006]
[204][server][cmp][/usr/sbin/postalias][checksum][f338a0c58cfe235db579d20bea4326fab24f8cb3][c95b319b6cf1427f6c4bcce2c73d6a616b2df0c9]
[206][server][cmp][/usr/sbin/postalias][inode][25433][25404]
[213][server][cmp][/usr/sbin/postalias][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:21 2006]
[204][server][cmp][/usr/sbin/postcat][checksum][fc47304764134988383104ef304f60252dcae749][df49b7fa733d217bb7f0ccec4d7b24b1417f8d21]
[206][server][cmp][/usr/sbin/postcat][inode][22626][25579]
[213][server][cmp][/usr/sbin/postcat][ctime][Fri Jun 30 03:20:48 2006][Sat Aug
12 04:02:20 2006]
[204][server][cmp][/usr/sbin/postconf][checksum][f9d25482431b3a5988e1025bb8abc5033a7517cb][86f6fb5dec3746aa6879a57f1acfac6dac31b85a]
[206][server][cmp][/usr/sbin/postconf][inode][25780][25556]
[213][server][cmp][/usr/sbin/postconf][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/sbin/postdrop][checksum][6c46e31450d7ac78dce9e840310af5859517eeeb][4409c5e06ec3e9c4e95bbec1ac46e2127cc6e568]
[206][server][cmp][/usr/sbin/postdrop][inode][25556][26239]
[213][server][cmp][/usr/sbin/postdrop][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/sbin/postkick][checksum][22f2b85a6e64a9828ed2d715464d4252177049f9][174444e88e6a6225a5be5cf91b96a79bffcee751]
[206][server][cmp][/usr/sbin/postkick][inode][26373][25973]
[213][server][cmp][/usr/sbin/postkick][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/sbin/postlock][checksum][8f294ff26d9ae1cc310c66067eb681fc73d87adc][1615d52feaab658f03ebb2f8b48886998722a478]
[206][server][cmp][/usr/sbin/postlock][inode][26379][22379]
[213][server][cmp][/usr/sbin/postlock][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/sbin/postlog][checksum][05e084e009f24c6dfec12569fee9c2244495fc0f][39974a2952de785a4eb348c21a01e6caa5c666be]
[206][server][cmp][/usr/sbin/postlog][inode][24994][22800]
[213][server][cmp][/usr/sbin/postlog][ctime][Fri Jun 30 03:20:50 2006][Sat Aug
12 04:02:21 2006]
[204][server][cmp][/usr/sbin/postmap][checksum][61a735999ec1ad6d865fceec01f1c21c78627519][9208a41a41b480664cb0110b945b206b1621fc3d]
[206][server][cmp][/usr/sbin/postmap][inode][25404][25310]
[213][server][cmp][/usr/sbin/postmap][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:21 2006]
[204][server][cmp][/usr/sbin/postqueue][checksum][67e91f182df00d3f1f37a6877bb8d82447eeb705][1c8a80fe7622f6ab8d5b80d5758cd478b430ec68]
[206][server][cmp][/usr/sbin/postqueue][inode][26375][26254]
[213][server][cmp][/usr/sbin/postqueue][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/sbin/postsuper][checksum][c22c5bb67ae4e726632d882ca500890ad517f8fe][0960a054e31de1e43fceb1a90657eb906cf441da]
[206][server][cmp][/usr/sbin/postsuper][inode][21335][26257]
[213][server][cmp][/usr/sbin/postsuper][ctime][Fri Jun 30 03:20:50 2006][Sat Aug
12 04:02:23 2006]
[204][server][cmp][/usr/sbin/rpc.gssd][checksum][00d368ba2e50ccd8e7818b033ecc2e760482fb58][94cd32ba2be8b42250371bb0b320db885d80ec13]
[206][server][cmp][/usr/sbin/rpc.gssd][inode][25317][25133]
[213][server][cmp][/usr/sbin/rpc.gssd][ctime][Thu Jun 29 21:43:51 2006][Sat Aug
12 04:02:21 2006]
[204][server][cmp][/usr/sbin/rpc.idmapd][checksum][c2e1487fa3a2b3c6920113794aa736cda1afbc23][f64318ecfebef5d775817c31f7125cd24e6c18fe]
[206][server][cmp][/usr/sbin/rpc.idmapd][inode][26225][21340]
[213][server][cmp][/usr/sbin/rpc.idmapd][ctime][Thu Jun 29 21:43:56 2006][Sat
Aug 12 04:02:23 2006]
[204][server][cmp][/usr/sbin/rpc.svcgssd][checksum][057aba4745e26e079cdcf3e25ff758a8fe8b99ac][6b5dbe025fee9c33e36143d7b77cd53a60395028]
[206][server][cmp][/usr/sbin/rpc.svcgssd][inode][26814][25042]
[213][server][cmp][/usr/sbin/rpc.svcgssd][ctime][Thu Jun 29 21:43:50 2006][Sat
Aug 12 04:02:21 2006]
[204][server][cmp][/usr/sbin/saslauthd][checksum][1aa8edafae567d6b6fb14f2eb49cdf4d830ca279][c3ebd0c10c4cfac0e0f85a91c7f679a149057026]
[206][server][cmp][/usr/sbin/saslauthd][inode][26815][26256]
[213][server][cmp][/usr/sbin/saslauthd][ctime][Thu Jun 29 21:43:51 2006][Sat Aug
12 04:02:22 2006]
[204][server][cmp][/usr/sbin/sendmail.postfix][checksum][50825933dd6029af8aa3c3cb7611a6c5e39252bd][33cc264aec19f9fb6386b6addca71e114cea982a]
[206][server][cmp][/usr/sbin/sendmail.postfix][inode][22800][25595]
[213][server][cmp][/usr/sbin/sendmail.postfix][ctime][Fri Jun 30 03:20:48
2006][Sat Aug 12 04:02:21 2006]
[204][server][cmp][/usr/sbin/smtp-sink][checksum][0cf6dac0dcb97d0910e843bf6a58ee8cec5278b1][3c3a2470a467d258e49eb17af3591fa8cbf20fe6]
[206][server][cmp][/usr/sbin/smtp-sink][inode][25310][24994]
[213][server][cmp][/usr/sbin/smtp-sink][ctime][Fri Jun 30 03:20:49 2006][Sat Aug
12 04:02:21 2006]
[204][server][cmp][/usr/sbin/smtp-source][checksum][892d51b76c4685ac3917c0dad1e0a6fe7ce50cd1][46ad415f1b9dbf6d0761c1f22ee8f12a9f153108]
[206][server][cmp][/usr/sbin/smtp-source][inode][22958][26253]
[213][server][cmp][/usr/sbin/smtp-source][ctime][Fri Jun 30 03:20:48 2006][Sat
Aug 12 04:02:21 2006]
[204][server][cmp][/usr/sbin/stunnel][checksum][77254c773406659daab7d70cb190a82b3b45d4cd][561ea970463ccc9ef6ef7f78eb26681645c24a31]
[206][server][cmp][/usr/sbin/stunnel][inode][21340][21335]
[213][server][cmp][/usr/sbin/stunnel][ctime][Thu Jun 29 21:43:56 2006][Sat Aug
12 04:02:23 2006]
Change Statistics:
----------------------------------
checksums: 27
SUID files: 0
root-owned files: 29
file permissions: 0
new: 0
missing: 0
total differences: 85
kfx.
William L. Maltby
2006-Aug-12 17:27 UTC
[CentOS] Several files's checksum change without reason
On Sat, 2006-08-12 at 19:10 +0200, kadafax wrote:> Hi list, > I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux > activated, Osiris (a decentralized scanner for files changes on distant > servers) signaled me several changes on files who were not (at first > sight) affected by a recent update (the list is below). > Is there a logic explanation for those changes to happen ? The "rpm -Va" > command does not output md5sum change for those files.Date/time looks like it might be a cron scheduled event. My bet is prelink. Have you looked at the crontabs and/or logs?> <snip>-- Bill -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part URL: <http://lists.centos.org/pipermail/centos/attachments/20060812/109b455a/attachment-0002.sig>
William L. Maltby wrote:> On Sat, 2006-08-12 at 19:10 +0200, kadafax wrote: > >> Hi list, >> I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux >> activated, Osiris (a decentralized scanner for files changes on distant >> servers) signaled me several changes on files who were not (at first >> sight) affected by a recent update (the list is below). >> Is there a logic explanation for those changes to happen ? The "rpm -Va" >> command does not output md5sum change for those files. >> > > Date/time looks like it might be a cron scheduled event. My bet is > prelink. Have you looked at the crontabs and/or logs? >prelink appears there: [root at server cron]# ll /etc/cron.daily/ total 76 lrwxrwxrwx 1 root root 28 Jun 29 20:27 00-logwatch -> ../log.d/scripts/logwatch.pl -rwxr-xr-x 1 root root 418 Feb 21 2005 00-makewhatis.cron -rwxr-xr-x 1 root root 276 Feb 21 2005 0anacron -rwxr-xr-x 1 root root 117 Mar 31 2005 epylog.cron -rwxr-xr-x 1 root root 180 Aug 23 2005 logrotate -rwxr-xr-x 1 root root 2133 Dec 1 2004 prelink -rwxr-xr-x 1 root root 104 Jan 1 2006 rpm -rwxr-xr-x 1 root root 121 Aug 22 2005 slocate.cron -rwxr-xr-x 1 root root 286 Feb 21 2005 tmpwatch -rwxr-xr-x 1 root root 158 Feb 18 15:38 yum.cron Nothing in logs ( grep cron /var/log/messages*) Is it possible for a cron job to modify binary's checksum and inode ?> >> <snip>^2 >> > >
Peter Kjellström
2006-Aug-14 07:09 UTC
[CentOS] Several files's checksum change without reason
On Saturday 12 August 2006 19:10, kadafax wrote:> Hi list, > I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux > activated, Osiris (a decentralized scanner for files changes on distant > servers) signaled me several changes on files who were not (at first > sight) affected by a recent update (the list is below). > Is there a logic explanation for those changes to happen ? The "rpm -Va" > command does not output md5sum change for those files.most likely prelink, rpm -V knows about prelink and is as such able to do the checksums regardless. prelink can be turned of in /etc/sysconfig/prelink if you don't want it. /Peter -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: not available URL: <http://lists.centos.org/pipermail/centos/attachments/20060814/fbca0b69/attachment-0002.sig>
Peter Kjellstr?m wrote:> On Saturday 12 August 2006 19:10, kadafax wrote: > >> Hi list, >> I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux >> activated, Osiris (a decentralized scanner for files changes on distant >> servers) signaled me several changes on files who were not (at first >> sight) affected by a recent update (the list is below). >> Is there a logic explanation for those changes to happen ? The "rpm -Va" >> command does not output md5sum change for those files. >> > > most likely prelink, rpm -V knows about prelink and is as such able to do the > checksums regardless. prelink can be turned of in /etc/sysconfig/prelink if > you don't want it. > > /Peter >Indeed the /var/log/prelink.log file shows changes related to my concern. I've looked at /usr/share/doc/prelink-0.3.3/prelink.pdf and one of the first thing said is that "it speeds up the launch of Open Office by 5 sec on a p3 650Mhz" ... Of course it doesn't only do that, but I'm not sure I really need it. Are there real advantages of using prelink in Centos for server purpose ? (actually a ssh gateway, but it's the same on a mail server) Thanks. kfx.