Strange file modification (SOLVED)

Support for security such as Firewalls and securing linux
Post Reply
link
Posts: 17
Joined: 2005/02/20 01:54:35

Strange file modification (SOLVED)

Post by link » 2005/04/07 17:07:44

Turns out the culprit was prelink. There's a nightly cron task that runs prelink on the entire system.

Original message follows:

I've been using AIDE to monitor file changes on system files on a new CentOS 4 server I built. I've been noticing an odd file change. The /usr/bin/ntpstat executable changes size at some point during the night. Even stranger, rpm -V ntp reveals no changes except for the config file. I don't have nightly yum updates enabled, and I would expect more changes if that were the case. I've uninstalled and reinstalled the latest ntp client, and the freshly installed ntpstat is the same size as the original, and the replacement is always the same size. Any idea what it is I'm seeing here? Thanks.

-Michael

Post Reply

Return to “CentOS 4 - Security Support”