William Hooper wrote: > John Ziniti wrote: >> I'm looking at some strange behavior on a _very_ barebones >> installation. I'd like to get some feedback on possible logical >> explanations. >> >> * What I'm seeing: The md5sum of all of my binaries in >> /usr/bin and /usr/sbin are changing exactly one hour >> after installation of CentOS-4.3. > > man prelink Aha! Well, the good news is that you are, of course, right and there is a logical explanation for this after all (Whew!). The only bad news I guess, is that I've wasted so much time looking for a mysterious problem that isn't there :-/ Just for posterity, the following was what I used to verify that the changes were from prelinking: # prelink --undo /usr/sbin/lsof # md5sum /usr/sbin/lsof The md5sum from that last command gave me the result I desired. Re-running prelink on /usr/sbin/lsof gives me the "foreign" md5sum again. I guess I'll just have to prelink from now on before I initialize tripwire. Thanks a ton, William. If you're ever in Boston, I owe you a [ affordable beverage of your choice ]. - JZ