Hello, I'm trying to determine if we're getting false positives on a recent rash of alerts from only one of several RHEL 4 AS servers we have in our farm. We received a slew of warnings (100+) about the MD5 checksum changing for our binaries:
<code> OSSEC HIDS Notification. 2008 Sep 05 05:39:33 Received From: (hostname) XXX.XXX.XXX.XXX->syscheck Rule: 550 fired (level 7) -> "Integrity checksum changed." Portion of the log(s): Integrity checksum changed for: '/usr/bin/ldapmodify' Old md5sum was: '923a6e19535fdf5bf6ebdaadd943b574' New md5sum is : '32d0f468d5f8fd564286f749d37c22b7' Old sha1sum was: '497e3e0ad4d3459d558991cf51883956c70d6e76' New sha1sum is : '858c5c67ea965685feeabd1193aef115e70a0b85' --END OF NOTIFICATION </code> What would cause this? Thanks, John
