On Mon, 15 Oct 2007 21:44:42 +0200 John Thompson <[EMAIL PROTECTED]> wrote: >These are the relevant lines. If you need more , please let me >know. >Thanks very much! > >[11:10:51] Warning: The file properties have changed: > >[11:10:51] File: /bin/sed >[11:10:51] Current hash: f157d60c55e7d5d90392feb5ab78613a491538f7 >[11:10:51] Stored hash : 4c933909719f1ac21794157d32fa3edf6efe1a02 >[11:10:51] Current inode: 852031 Stored inode: 851970 >[11:10:51] Current size: 40436 Stored size: 40308 >[11:10:52] Current file modification time: 1191079864 >[11:10:52] Stored file modification time : 1187193844
Looks like an upgrade to me. Verify by checking the packages contents changed as well and any other changes got logged by your system around that modification time? System logging and a timeline of changes should tell. If you previously deployed a dedicated file integrity checker (and saved a copy of the db off-site) like Aide, Samhain or even tripwire, now is the time to use it :-] Cheers, unSpawn N.N.: Do keep it on the list, for archival purposes, unless explicitly asked otherwise. ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
