Rob Skoog wrote: > I recently installed OSSEC on a host and a day or two later an alert > email showed a bunch of checksum alerts for several different files. > > This is one example: > OSSEC HIDS Notification. > 2008 Apr 01 08:40:21 > > Received From: gravel->syscheck > Rule: 550 fired (level 7) -> "Integrity checksum changed." > Portion of the log(s): > > Integrity checksum changed for: '/usr/bin/yelp' > Old md5sum was: '6e1ae6c66c698178e10811ee75899931' > New md5sum is : 'ac0c2f17040cfd072e79b138056aa71e' > Old sha1sum was: '20334f1f9b133d3018c7cebf685f2a3c4fd78b19' > New sha1sum is : '4f9b48a1eba833fba34d007e0aa878960ec789e8' > > My yum.log shows no updates after the 28th of march. > > So I decided to investigate further this one result picked at random. > > uname -a > Linux <scrubbed> 2.6.18-53.1.6.el5 #1 SMP Wed Jan 23 11:30:20 EST 2008 > i686 i686 i386 GNU/Linux > > [EMAIL PROTECTED] log]# rpm -qf /usr/bin/yelp > yelp-2.16.0-15.el5 > [EMAIL PROTECTED] log]# md5sum /usr/bin/yelp > ac0c2f17040cfd072e79b138056aa71e /usr/bin/yelp > [EMAIL PROTECTED] etc]# rpm -qf --dump /usr/bin/yelp | grep /usr/bin/yelp > /usr/bin/yelp 227148 1180690916 150e154010e876475681c253f98b5be8 0100755 > root root 0 0 0 X > > Which seems to be a third md5sum for the file based on the rpm. > > After removing an reinstalling the package... > [EMAIL PROTECTED] log]# md5sum /usr/bin/yelp > 150e154010e876475681c253f98b5be8 /usr/bin/yelp > [EMAIL PROTECTED] log]# rpm -qf /usr/bin/yelp > yelp-2.16.0-15.el5 > [EMAIL PROTECTED] log]# > > [EMAIL PROTECTED] log]# rpm -qf --dump /usr/bin/yelp | grep /usr/bin/yelp > /usr/bin/yelp 227148 1180690916 150e154010e876475681c253f98b5be8 0100755 > root root 0 0 0 X > > Oh and on a different machine..... > > [EMAIL PROTECTED] ~]$ md5sum /usr/bin/yelp > a4e4e21adb51e04959ad1f05f47268a2 /usr/bin/yelp > [EMAIL PROTECTED] ~]$ rpm -qf /usr/bin/yelp > yelp-2.16.0-15.el5 > [EMAIL PROTECTED] ~]$ uname -a > Linux <scrubbed> 2.6.18-53.1.14.el5 #1 SMP Wed Mar 5 11:36:49 > EST 2008 i686 i686 i386 GNU/Linux > [EMAIL PROTECTED] ~]$ rpm -qf --dump /usr/bin/yelp | grep /usr/bin/yelp > /usr/bin/yelp 227148 1180690916 150e154010e876475681c253f98b5be8 0100755 > root root 0 0 0 X > > after removing it and reinstalling though.... > [EMAIL PROTECTED] ~]$ md5sum /usr/bin/yelp > 150e154010e876475681c253f98b5be8 /usr/bin/yelp > > Doing an rpm -V yelp though always returns no issues with the binaries > with different checksums. > > We also tried experimenting some with other files, for example: > [EMAIL PROTECTED] log]# md5sum /usr/bin/perl > 9a9245039782813967a6706a45f623c6 /usr/bin/perl > [EMAIL PROTECTED] log]# rpm -qf --dump /usr/bin/perl | grep /usr/bin/perl > /usr/bin/perl 11192 1194523209 e7640cdfec7a02f3d4b4c984fb20a304 0100755 > root root 0 0 0 X > > Didn't have matching hashes either across machines even though the file > size was the same. > > I also asked others on different networks at random to do the same thing > with a random executable binary and they produced similar results. > Hashes that didn't match across machines or the rpm database. > > Is there a fundamental understanding I'm lacking of executable binaries > and file hashes? Is everything I'm looking at just owned :) (unlikely > we think) or do others see the same thing? > > The package in question was: > bash-3.1$ rpm -qi yelp > Name : yelp Relocations: (not relocatable) > Version : 2.16.0 Vendor: CentOS > Release : 15.el5 Build Date: Fri 01 Jun 2007 > 05:41:56 AM EDT > Install Date: Thu 03 Apr 2008 09:56:44 AM EDT Build Host: > builder4.centos.org > Group : Applications/System Source RPM: > yelp-2.16.0-15.el5.src.rpm > Size : 2025109 License: GPL > Signature : DSA/SHA1, Sat 02 Jun 2007 05:30:31 AM EDT, Key ID > a8a447dce8562897 > Summary : A system documentation reader from the Gnome project > Description : > Yelp is the Gnome 2 help/documentation browser. It is designed > to help you browse all the documentation on your system in > one central tool. > bash-3.1$ > > > Thanks, > Rob Skoog > > Spent way to much time figuring this out, but best guess at the moment is that is has to do with binaries that are prelinked.
http://en.wikipedia.org/wiki/Prelinking Supposedly it modifies the binary so it can start faster, but consequently it would make the check sum change. doing a: prelink -y --md5 /usr/bin/perl gives the correct md5 hash shown in the signed rpms. Regards, Rob Skoog
