Hello, all!
I run an OpenBSD 4.0 system, all patches installed. The installation is
rather basic, the only port open to the world is ssh, which provides
access to a subversion server and to shell logins, both via keys, or
one-time :skey passwords. As the system is exposed to the net, I
regularly verify checksums of all files using aide (installed from
packages). So, recently I noticed the following:
# /some/path/aide --config=/my/config --update > /tmp/1
# vi /tmp/1
... snip ...
changed:/usr/lib/libasn1.a
changed:/usr/lib/libkafs_pic.a
changed:/usr/lib/libkrb5_pic.a
... snip ...
File: /usr/lib/libasn1.a
MD5 : Wrpax8YvU84JUMMSlIZexQ== , b5em5b4AETeIpboM+NsSQA==
File: /usr/lib/libkafs_pic.a
MD5 : voiA+l3kYINweu83pWDfLA== , AIjWbC687J7lD+QSDd7pwg==
File: /usr/lib/libkrb5_pic.a
MD5 : voiA+l3kYINweu83pWDfLA== , AIjWbC687J7lD+QSDd7pwg==
... snip ...
The previous check was on May 17, i.e. 5 days ago. After that date the
only modifications were:
- installed couple packages (wget, screen)
- edited ~/.ssh/config for one user (non-root), logged over ssh to a new
Linux system
- ran normal subversion activity, checkins, checkouts, etc.
It the above change in MD5 checksums normal? If yes, what caused it and
why nothing like this was observed before?
Best regards,
Dmitry
