John Simone wrote: > Hello, > > I'm trying to determine if we're getting false positives on a recent > rash of alerts from only one of several RHEL 4 AS servers we have in > our farm. We received a slew of warnings (100+) about the MD5 > checksum changing for our binaries: > > <code> > OSSEC HIDS Notification. > 2008 Sep 05 05:39:33 > > Received From: (hostname) XXX.XXX.XXX.XXX->syscheck > Rule: 550 fired (level 7) -> "Integrity checksum changed." > Portion of the log(s): > > Integrity checksum changed for: '/usr/bin/ldapmodify' > Old md5sum was: '923a6e19535fdf5bf6ebdaadd943b574' > New md5sum is : '32d0f468d5f8fd564286f749d37c22b7' > Old sha1sum was: '497e3e0ad4d3459d558991cf51883956c70d6e76' > New sha1sum is : '858c5c67ea965685feeabd1193aef115e70a0b85' > > > > --END OF NOTIFICATION > </code> > > What would cause this? > > Thanks, > John
Is prelinking enabled? See: http://www.ossec.net/wiki/index.php/Know_How:Check_Sums Rob
