On Friday 05 September 2008 10:40:47 John Simone wrote: > Hello, > > I'm trying to determine if we're getting false positives on a recent > rash of alerts from only one of several RHEL 4 AS servers we have in > our farm. We received a slew of warnings (100+) about the MD5 > checksum changing for our binaries: > > What would cause this? > > Thanks, > John
Have you checked to make sure the MD5s have actually changed? Or, more importantly, have you checked on another machine to see if they match? I have two machines, 'bacenstein' and 'balin', that sporadically get..."confused". Bacenstein is the OSSEC server and balin is just a client. Every now and then, I'll get a report from OSSEC that pretty much every file on balin had changed. I panicked the first time because balin is in the DMZ and it's entirely likely. What had apparently happened was that, under some circumstance that I can't duplicate (and therefore can't file a bug report), it either sends me a notification with the wrong machine name OR it crosses the checksum database. So what was happening is that /etc/passwd had sum "A1" on bacenstein and sum "3D" on balin. OSSEC was reading bacenstein's checksum (A1) but comparing it against sum stored for balin (3D)....and then notifying me that both had changed. I ssh'd in to it and checked the sums by hand; both were fine. Tripwire was fine. But then I noticed that the host:sum listing was reversed for all values and that, compared to previous runs, the sums were fine. It corrected itself sometime later and notified me that all of the sums had changed again, but in reverse from the last time. It's only happened to me three times in about 6 months so I just ignored it, but that could be happening to you. Wes
