Hi list, I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux activated, Osiris (a decentralized scanner for files changes on distant servers) signaled me several changes on files who were not (at first sight) affected by a recent update (the list is below). Is there a logic explanation for those changes to happen ? The "rpm -Va" command does not output md5sum change for those files.
compare time: Sat Aug 12 05:35:14 2006 host: server scan config: server (abcdefg) log file: no log file generated, see system log. base database: 56 compare database: 57
[211][server][cmp][/usr/bin][mtime][Sun Aug 6 04:02:20 2006][Sat Aug 12 04:02:22 2006] [213][server][cmp][/usr/bin][ctime][Sun Aug 6 04:02:20 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/bin/afs5log][checksum][b838bb6106250fdfd95ae8a7dc7fa95b8f762df4][a4c817dd8ca12449dc1a8bdf7f972c19aa3ffd7b] [206][server][cmp][/usr/bin/afs5log][inode][22423][22422] [213][server][cmp][/usr/bin/afs5log][ctime][Thu Jun 29 21:43:54 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/bin/dig][checksum][9d34eb65d61c9f43efc9b6141f727e7fdbb618bf][69d94a240e415b5f22a220fe71dcf865a9a5608c] [206][server][cmp][/usr/bin/dig][inode][25755][25759] [213][server][cmp][/usr/bin/dig][ctime][Thu Jun 29 21:43:48 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/bin/elinks][checksum][a62ab203cc0126aa846419ca25e2e2a6524ab58d][a66553759b6392f20b4f4c61d798585636feea9e] [206][server][cmp][/usr/bin/elinks][inode][26239][25433] [213][server][cmp][/usr/bin/elinks][ctime][Thu Jul 27 04:02:16 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/bin/host][checksum][f6e94925f133d1a9fe088da757ec60b493800adc][c47534726541474f7a1e1b7d23ec41ed44169118] [206][server][cmp][/usr/bin/host][inode][25133][22958] [213][server][cmp][/usr/bin/host][ctime][Thu Jun 29 21:43:51 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/bin/ipmi_ui][checksum][e106a461a907d0dec9f622919ddaed1a84552063][1bb99621c20d3e66f362a355d8d8e09340f748d6] [206][server][cmp][/usr/bin/ipmi_ui][inode][25973][21341] [213][server][cmp][/usr/bin/ipmi_ui][ctime][Thu Jun 29 21:43:53 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/bin/ipmish][checksum][f4f38f1f45f83d057b32deb2dbae9940f9d9dcc0][6e13d56f5457213de8302e08c311badcd49b1e46] [206][server][cmp][/usr/bin/ipmish][inode][25042][25755] [213][server][cmp][/usr/bin/ipmish][ctime][Thu Jun 29 21:43:50 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/bin/nslookup][checksum][7f7087ace44e1d14e984cd367df3b794cc1859a3][655c9d0f1328aa07f45a061825989809ae5b9885] [206][server][cmp][/usr/bin/nslookup][inode][25595][25317] [213][server][cmp][/usr/bin/nslookup][ctime][Thu Jun 29 21:43:51 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/bin/nsupdate][checksum][721695ed63aed8b55d6978b1384a0250d26d4d15][cac7585a8520d619d1a507b160e7a35651db3563] [206][server][cmp][/usr/bin/nsupdate][inode][21341][25780] [213][server][cmp][/usr/bin/nsupdate][ctime][Thu Jun 29 21:43:53 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/bin/openssl][checksum][c728d401456ee2003a329eb74e1ea3f008ddcf17][ddc4e323567fac0696dd9aeacea7402869837ff7] [206][server][cmp][/usr/bin/openssl][inode][22379][22423] [213][server][cmp][/usr/bin/openssl][ctime][Thu Jun 29 21:43:54 2006][Sat Aug 12 04:02:22 2006] [211][server][cmp][/usr/sbin][mtime][Fri Jul 28 12:45:00 2006][Sat Aug 12 04:02:23 2006] [213][server][cmp][/usr/sbin][ctime][Fri Jul 28 12:45:00 2006][Sat Aug 12 04:02:23 2006] [204][server][cmp][/usr/sbin/postalias][checksum][f338a0c58cfe235db579d20bea4326fab24f8cb3][c95b319b6cf1427f6c4bcce2c73d6a616b2df0c9] [206][server][cmp][/usr/sbin/postalias][inode][25433][25404] [213][server][cmp][/usr/sbin/postalias][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/postcat][checksum][fc47304764134988383104ef304f60252dcae749][df49b7fa733d217bb7f0ccec4d7b24b1417f8d21] [206][server][cmp][/usr/sbin/postcat][inode][22626][25579] [213][server][cmp][/usr/sbin/postcat][ctime][Fri Jun 30 03:20:48 2006][Sat Aug 12 04:02:20 2006] [204][server][cmp][/usr/sbin/postconf][checksum][f9d25482431b3a5988e1025bb8abc5033a7517cb][86f6fb5dec3746aa6879a57f1acfac6dac31b85a] [206][server][cmp][/usr/sbin/postconf][inode][25780][25556] [213][server][cmp][/usr/sbin/postconf][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/sbin/postdrop][checksum][6c46e31450d7ac78dce9e840310af5859517eeeb][4409c5e06ec3e9c4e95bbec1ac46e2127cc6e568] [206][server][cmp][/usr/sbin/postdrop][inode][25556][26239] [213][server][cmp][/usr/sbin/postdrop][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/sbin/postkick][checksum][22f2b85a6e64a9828ed2d715464d4252177049f9][174444e88e6a6225a5be5cf91b96a79bffcee751] [206][server][cmp][/usr/sbin/postkick][inode][26373][25973] [213][server][cmp][/usr/sbin/postkick][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/sbin/postlock][checksum][8f294ff26d9ae1cc310c66067eb681fc73d87adc][1615d52feaab658f03ebb2f8b48886998722a478] [206][server][cmp][/usr/sbin/postlock][inode][26379][22379] [213][server][cmp][/usr/sbin/postlock][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/sbin/postlog][checksum][05e084e009f24c6dfec12569fee9c2244495fc0f][39974a2952de785a4eb348c21a01e6caa5c666be] [206][server][cmp][/usr/sbin/postlog][inode][24994][22800] [213][server][cmp][/usr/sbin/postlog][ctime][Fri Jun 30 03:20:50 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/postmap][checksum][61a735999ec1ad6d865fceec01f1c21c78627519][9208a41a41b480664cb0110b945b206b1621fc3d] [206][server][cmp][/usr/sbin/postmap][inode][25404][25310] [213][server][cmp][/usr/sbin/postmap][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/postqueue][checksum][67e91f182df00d3f1f37a6877bb8d82447eeb705][1c8a80fe7622f6ab8d5b80d5758cd478b430ec68] [206][server][cmp][/usr/sbin/postqueue][inode][26375][26254] [213][server][cmp][/usr/sbin/postqueue][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/sbin/postsuper][checksum][c22c5bb67ae4e726632d882ca500890ad517f8fe][0960a054e31de1e43fceb1a90657eb906cf441da] [206][server][cmp][/usr/sbin/postsuper][inode][21335][26257] [213][server][cmp][/usr/sbin/postsuper][ctime][Fri Jun 30 03:20:50 2006][Sat Aug 12 04:02:23 2006] [204][server][cmp][/usr/sbin/rpc.gssd][checksum][00d368ba2e50ccd8e7818b033ecc2e760482fb58][94cd32ba2be8b42250371bb0b320db885d80ec13] [206][server][cmp][/usr/sbin/rpc.gssd][inode][25317][25133] [213][server][cmp][/usr/sbin/rpc.gssd][ctime][Thu Jun 29 21:43:51 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/rpc.idmapd][checksum][c2e1487fa3a2b3c6920113794aa736cda1afbc23][f64318ecfebef5d775817c31f7125cd24e6c18fe] [206][server][cmp][/usr/sbin/rpc.idmapd][inode][26225][21340] [213][server][cmp][/usr/sbin/rpc.idmapd][ctime][Thu Jun 29 21:43:56 2006][Sat Aug 12 04:02:23 2006] [204][server][cmp][/usr/sbin/rpc.svcgssd][checksum][057aba4745e26e079cdcf3e25ff758a8fe8b99ac][6b5dbe025fee9c33e36143d7b77cd53a60395028] [206][server][cmp][/usr/sbin/rpc.svcgssd][inode][26814][25042] [213][server][cmp][/usr/sbin/rpc.svcgssd][ctime][Thu Jun 29 21:43:50 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/saslauthd][checksum][1aa8edafae567d6b6fb14f2eb49cdf4d830ca279][c3ebd0c10c4cfac0e0f85a91c7f679a149057026] [206][server][cmp][/usr/sbin/saslauthd][inode][26815][26256] [213][server][cmp][/usr/sbin/saslauthd][ctime][Thu Jun 29 21:43:51 2006][Sat Aug 12 04:02:22 2006] [204][server][cmp][/usr/sbin/sendmail.postfix][checksum][50825933dd6029af8aa3c3cb7611a6c5e39252bd][33cc264aec19f9fb6386b6addca71e114cea982a] [206][server][cmp][/usr/sbin/sendmail.postfix][inode][22800][25595] [213][server][cmp][/usr/sbin/sendmail.postfix][ctime][Fri Jun 30 03:20:48 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/smtp-sink][checksum][0cf6dac0dcb97d0910e843bf6a58ee8cec5278b1][3c3a2470a467d258e49eb17af3591fa8cbf20fe6] [206][server][cmp][/usr/sbin/smtp-sink][inode][25310][24994] [213][server][cmp][/usr/sbin/smtp-sink][ctime][Fri Jun 30 03:20:49 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/smtp-source][checksum][892d51b76c4685ac3917c0dad1e0a6fe7ce50cd1][46ad415f1b9dbf6d0761c1f22ee8f12a9f153108] [206][server][cmp][/usr/sbin/smtp-source][inode][22958][26253] [213][server][cmp][/usr/sbin/smtp-source][ctime][Fri Jun 30 03:20:48 2006][Sat Aug 12 04:02:21 2006] [204][server][cmp][/usr/sbin/stunnel][checksum][77254c773406659daab7d70cb190a82b3b45d4cd][561ea970463ccc9ef6ef7f78eb26681645c24a31] [206][server][cmp][/usr/sbin/stunnel][inode][21340][21335] [213][server][cmp][/usr/sbin/stunnel][ctime][Thu Jun 29 21:43:56 2006][Sat Aug 12 04:02:23 2006]
Change Statistics: ----------------------------------
checksums: 27 SUID files: 0 root-owned files: 29 file permissions: 0 new: 0 missing: 0
total differences: 85
kfx.
On Sat, 2006-08-12 at 19:10 +0200, kadafax wrote:
Hi list, I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux activated, Osiris (a decentralized scanner for files changes on distant servers) signaled me several changes on files who were not (at first sight) affected by a recent update (the list is below). Is there a logic explanation for those changes to happen ? The "rpm -Va" command does not output md5sum change for those files.
Date/time looks like it might be a cron scheduled event. My bet is prelink. Have you looked at the crontabs and/or logs?
<snip>
William L. Maltby wrote:
On Sat, 2006-08-12 at 19:10 +0200, kadafax wrote:
Hi list, I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux activated, Osiris (a decentralized scanner for files changes on distant servers) signaled me several changes on files who were not (at first sight) affected by a recent update (the list is below). Is there a logic explanation for those changes to happen ? The "rpm -Va" command does not output md5sum change for those files.
Date/time looks like it might be a cron scheduled event. My bet is prelink. Have you looked at the crontabs and/or logs?
prelink appears there: [root@server cron]# ll /etc/cron.daily/ total 76 lrwxrwxrwx 1 root root 28 Jun 29 20:27 00-logwatch -> ../log.d/scripts/logwatch.pl -rwxr-xr-x 1 root root 418 Feb 21 2005 00-makewhatis.cron -rwxr-xr-x 1 root root 276 Feb 21 2005 0anacron -rwxr-xr-x 1 root root 117 Mar 31 2005 epylog.cron -rwxr-xr-x 1 root root 180 Aug 23 2005 logrotate -rwxr-xr-x 1 root root 2133 Dec 1 2004 prelink -rwxr-xr-x 1 root root 104 Jan 1 2006 rpm -rwxr-xr-x 1 root root 121 Aug 22 2005 slocate.cron -rwxr-xr-x 1 root root 286 Feb 21 2005 tmpwatch -rwxr-xr-x 1 root root 158 Feb 18 15:38 yum.cron
Nothing in logs ( grep cron /var/log/messages*)
Is it possible for a cron job to modify binary's checksum and inode ?
<snip>^2
On Sat, 2006-08-12 at 23:15 +0200, kadafax wrote:
William L. Maltby wrote:
On Sat, 2006-08-12 at 19:10 +0200, kadafax wrote:
<snip>
... several changes on files who were not (at first sight) affected by a recent update (the list is below). Is there a logic explanation for those changes to happen ? The "rpm -Va" command does not output md5sum change for those files.
Date/time looks like it might be a cron scheduled event. My bet is prelink. Have you looked at the crontabs and/or logs?
prelink appears there: [root@server cron]# ll /etc/cron.daily/ total 76 lrwxrwxrwx 1 root root 28 Jun 29 20:27 00-logwatch -> ../log.d/scripts/logwatch.pl -rwxr-xr-x 1 root root 418 Feb 21 2005 00-makewhatis.cron -rwxr-xr-x 1 root root 276 Feb 21 2005 0anacron -rwxr-xr-x 1 root root 117 Mar 31 2005 epylog.cron -rwxr-xr-x 1 root root 180 Aug 23 2005 logrotate
-rwxr-xr-x 1 root root 2133 Dec 1 2004 prelink -rwxr-xr-x 1 root root 104 Jan 1 2006 rpm -rwxr-xr-x 1 root root 121 Aug 22 2005 slocate.cron -rwxr-xr-x 1 root root 286 Feb 21 2005 tmpwatch -rwxr-xr-x 1 root root 158 Feb 18 15:38 yum.cron
Nothing in logs ( grep cron /var/log/messages*)
$ locate prelink /etc/prelink.cache
...
/var/log/prelink.log /var/log/prelink.log.1.bz2
<snip>
Is it possible for a cron job to modify binary's checksum and inode ?
Yes. If cron is user with proper permissions, ACLs don't prevent and SELinux doesn't prevent. Cron is (in effect) just another user (may be root) that runs jobs automatically.
I suggest you investigate the software that may be affecting the systems you have under your control.
Prelink will change size, date, i-node, ...
<snip>
On Saturday 12 August 2006 19:10, kadafax wrote:
Hi list, I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux activated, Osiris (a decentralized scanner for files changes on distant servers) signaled me several changes on files who were not (at first sight) affected by a recent update (the list is below). Is there a logic explanation for those changes to happen ? The "rpm -Va" command does not output md5sum change for those files.
most likely prelink, rpm -V knows about prelink and is as such able to do the checksums regardless. prelink can be turned of in /etc/sysconfig/prelink if you don't want it.
/Peter
Peter Kjellström wrote:
On Saturday 12 August 2006 19:10, kadafax wrote:
Hi list, I'm a bit worried here. On a server, Centos 4.3 fully-patched SELinux activated, Osiris (a decentralized scanner for files changes on distant servers) signaled me several changes on files who were not (at first sight) affected by a recent update (the list is below). Is there a logic explanation for those changes to happen ? The "rpm -Va" command does not output md5sum change for those files.
most likely prelink, rpm -V knows about prelink and is as such able to do the checksums regardless. prelink can be turned of in /etc/sysconfig/prelink if you don't want it.
/Peter
Indeed the /var/log/prelink.log file shows changes related to my concern. I've looked at /usr/share/doc/prelink-0.3.3/prelink.pdf and one of the first thing said is that "it speeds up the launch of Open Office by 5 sec on a p3 650Mhz" ... Of course it doesn't only do that, but I'm not sure I really need it. Are there real advantages of using prelink in Centos for server purpose ? (actually a ssh gateway, but it's the same on a mail server) Thanks. kfx.
-
kadafax -
Peter Kjellström -
William L. Maltby