Hi,
after a long weekend I found this seccheck output in my inbox:
---cut---
The following programs have got a different md5 checksum since last
week:
+ ++ /var/lib/secchk/data/rpm-md5.new Sun Oct 6 23:13:52 2002
+ SM5....T /usr/share/groff
+ S.5....T /usr/share/info/gzip.info.gz
+ SM5....T /usr/lib/kbd
+ SM5....T /sbin/conf.d/SuSEconfig.pam
+ S.5....T /usr/share/doc/packages/pam/modules/README.pam_unix
+ S.5....T /usr/share/doc/packages/pam/modules/README.pam_warn
+ SM5....T /sbin/conf.d/SuSEconfig.perl
+ SM5....T /usr/lib/perl5/5.6.0/i586-linux
+ S.5....T /usr/share/terminfo/x/xterm-xi
+ S.5....T /usr/share/terminfo/x/xterm1
+ S.5....T /usr/share/terminfo/x/xtermc
+ SM5....T /usr/share/terminfo/x/xterms
+ S.5....T /usr/share/terminfo/x/xterms-sun
+ SM5....T /usr/share/terminfo/x/xwsh
+ SM5....T /usr/share/terminfo/z/z19
+ S.5....T /usr/share/terminfo/z/z29a
+ SM5....T /usr/share/terminfo/z/z29a-kc-bc
+ S.5....T /usr/share/terminfo/z/z29a-kc-uc
+ S.5....T /usr/share/terminfo/z/z29a-nkc-bc
+ S.5....T /usr/share/terminfo/z/z29a-nkc-uc
+ SM5....T /usr/share/terminfo/z/z29b
+ SM5....T /usr/share/terminfo/z/z30
+ S.5....T /usr/share/terminfo/z/z340
+ S.5....T /usr/share/terminfo/z/z340-nam
+ S.5....T /usr/share/terminfo/z/z39-a
+ SM5....T /usr/share/terminfo/z/z39a
+ SM5....T /usr/share/terminfo/z/z8001
+ S.5....T /usr/share/terminfo/z/zen50
+ SM5....T /usr/share/terminfo/z/zen8001
+ SM5....T /usr/share/terminfo/z/zenith
+ SM5....T /usr/share/terminfo/z/zenith29
+ SM5....T /usr/share/terminfo/z/zenith39-a
+ SM5....T /usr/share/terminfo/z/zenith39-ansi
+ SM5....T /usr/share/terminfo/z/zt-1
+ S.5....T /usr/share/terminfo/z/ztx
+ SM5....T /usr/share/terminfo/z/ztx-1-a
+ SM5....T /usr/share/terminfo/z/ztx11
+ S.5....T /usr/include/curses.h
+ SM5....T /usr/bin/setfdprm
+ SM5...GT /usr/bin/wall
+ SM5....T /usr/bin/whereis
+ S.5....T /usr/share/locale/nl/LC_MESSAGES/util-linux.mo
+ SM5....T c /etc/init.d/idedma
- S.5....T c /etc/init.d/gpm
+ SM5....T c /etc/init.d/gpm
+ SM5....T /usr/share/locale/sl/LC_MESSAGES/popt.mo
+ S.5....T /usr/share/locale/tr/LC_MESSAGES/popt.mo
+ SM5....T /etc/init.d/dhclient
+ S.5....T /usr/share/info/textutils.info.gz
+ S.5....T /usr/share/locale/nl/LC_MESSAGES/textutils.mo
+ SM5....T /usr/bin/c++filt
+ SM5....T /usr/bin/cc
+ SM5....T /usr/bin/cpp
+ SM5....T /usr/bin/gcc
+ SM5....T /usr/bin/gcov
+ SM5....T /usr/bin/protoize
+ SM5....T /usr/bin/unprotoize
- S.5....T /var/spool/atjobs/.SEQ
+ SM5....T c /etc/init.d/at
+ SM5..UGT /var/spool/atjobs/.SEQ
+ SM5....T /usr/bin/ld
+ SM5....T /usr/bin/nm
+ SM5....T /usr/bin/objcopy
+ SM5....T /usr/bin/objdump
+ SM5....T /usr/bin/ranlib
+ SM5....T /usr/bin/readelf
+ SM5....T /usr/bin/size
+ SM5....T /usr/bin/strings
+ SM5....T /usr/bin/strip
+ SM5....T c /etc/init.d/sshd
+ S.5....T /usr/share/locale/nl/LC_MESSAGES/wget.mo
+ SM5....T c /etc/init.d/argus
+ SM5....T /etc/init.d/scanlogd
+ SM5....T c /etc/init.d/i4l
+ SM5....T c /etc/init.d/i4l_hardware
+ SM5....T c /etc/init.d/sendmail
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/sys_timer.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/trident.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/trident.h
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/trix.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/tuning.h
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/uart401.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/uart6850.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/ulaw.h
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/v_midi.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/v_midi.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/drivers/sound/via82cxxx_audio.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/vidc.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/vidc.h
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/vidc_fill.S
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/vidc_synth.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/vwsnd.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/waveartist.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/waveartist.h
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/wavfront.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/wf_midi.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/ymfpci.c
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/ymfpci.h
- S.5....T /usr/src/linux-2.2.19.SuSE/drivers/sound/ymfpci_image.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/apm.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/autofs/fs.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/binfmt/misc.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/3w/xxxx/raid.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/aec62xx.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/ali15x3.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/cmd640/enhanced.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/cmd64x.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/cs5530.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/idefloppy.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/blk/dev/loop.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/blk/dev/sd.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/blk/dev/sr.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/bsd/disklabel.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/bsd/process/acct.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/chr/dev/osst.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/chr/dev/sg.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/chr/dev/st.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/configlang/english.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/configlang/german.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/dummy/module.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/eexpress/pro100.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/experimental.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/fat/fs.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/filter.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/firewall.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/idedma/pci/experimental.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/idepci/share/irq.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/inet/rarp.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/ip/advanced/router.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/ip/alias.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/ip/multicast.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/ip/pnp.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/joliet.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/kmod.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/m486.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/m686.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/mac/partition.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/magic/sysrq.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/minix/fs.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/msdos/fs.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/mtrr.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/net/sched.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/netlink.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/nfs/v3.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/nls.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/nvram.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/paride/parport.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/ppscsi.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/proc/config.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/quota.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/reiserfs/fs.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/rtc.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/7000fasst.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/aacraid.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/acard.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/advansys.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/aha152x.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/aha1542.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/aha1740.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/aic7xxx.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/aic7xxx/old.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/am53c974.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/buslogic.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/constants.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/cpqfcts.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/dc390t.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/dpt/i2o.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/dtc3280.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/eata.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/eata/dma.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/eata/pio.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/future/domain.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/gdth.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/generic/ncr5380.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/in2000.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/inia100.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/initio.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/ips.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/logging.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/megaraid.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/multi/lun.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c406a.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c7xx.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c8xx.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c8xx/default/tag
s.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c8xx/iomapped.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c8xx/max/tags.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c8xx/pqs/pds.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ncr53c8xx/sync.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/pas16.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/pci2000.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/pci2220i.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/psi240i.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/qlogic/1280.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/qlogic/fas.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/qlogic/fc.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/qlogic/isp.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/qlogic/qla2x00.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/seagate.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/sim710.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/sym53c416.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/sym53c8xx.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/scsi/t128.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/u14/34f.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/scsi/ultrastor.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/serial/console.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/serial/extended.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/serial/nonstandard.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/smd/disklabel.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/solaris/x86/partition.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/syn/cookies.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/umsdos/fs.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/vfat/fs.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/video/select.h
- S.5....T
/usr/src/linux-2.2.19.SuSE/include/config/x86/good/apic.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/config/x86/tsc.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/linux/autoconf.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/linux/compile.h
- S.5....T /usr/src/linux-2.2.19.SuSE/include/linux/config_data.h
+ S.5....T /usr/share/man/allman/man2/sysctl.2.gz
+ S.5....T /usr/share/man/allman/man2/sysfs.2.gz
+ S.5....T /usr/share/man/allman/man2/sysinfo.2.gz
+ S.5....T /usr/share/man/allman/man2/syslog.2.gz
+ S.5....T /usr/share/man/allman/man2/time.2.gz
+ S.5....T /usr/share/man/allman/man2/times.2.gz
+ S.5....T /usr/share/man/allman/man2/trecv.2.gz
+ S.5....T /usr/share/man/allman/man2/truncate.2.gz
+ S.5....T /usr/share/man/allman/man2/tsend.2.gz
+ S.5....T /usr/share/man/allman/man2/umask.2.gz
+ S.5....T /usr/share/man/allman/man2/uname.2.gz
+ S.5....T /usr/share/man/allman/man2/unimplemented.2.gz
+ S.5....T /usr/share/man/allman/man2/unlink.2.gz
+ S.5....T /usr/share/man/allman/man2/uselib.2.gz
+ S.5....T /usr/share/man/allman/man2/ustat.2.gz
+ S.5....T /usr/share/man/allman/man2/utime.2.gz
+ S.5....T /usr/share/man/allman/man2/utimes.2.gz
+ S.5....T /usr/share/man/allman/man2/vfork.2.gz
+ S.5....T /usr/share/man/allman/man2/vhangup.2.gz
+ S.5....T /usr/share/man/allman/man2/vm86.2.gz
+ S.5....T /usr/share/man/allman/man2/wait.2.gz
+ S.5....T /usr/share/man/allman/man2/wait3.2.gz
+ S.5....T /usr/share/man/allman/man2/waitpid.2.gz
+ S.5....T /usr/share/man/allman/man2/writev.2.gz
+ SM5....T /usr/share/man/allman/man6
+ SM5....T /usr/share/man/allman/man7
+ SM5....T /usr/share/man/allman/man8
+ SM5....T /usr/share/man/allman/man9
+ SM5....T /usr/share/man/allman/mann
+ SM5....T /usr/src/linux-2.2.19.SuSE
+ SM5....T /usr/bin/rvim
+ SM5....T /usr/bin/vi
+ SM5....T /usr/bin/view
+ SM5....T /usr/bin/vimtutor
+ SM5....T /usr/bin/xxd
+ SM5....T /usr/share/vim/vim57/macros/hanoi
+ SM5....T /usr/share/vim/vim57/macros/life
+ SM5....T /usr/share/vim/vim57/syntax
+ SM5....T /usr/bin/sprof
+ SM5....T /usr/bin/tzselect
+ SM5....T /usr/bin/xtrace
+ S.5....T /usr/lib/locale/af_ZA/LC_NAME
+ S.5....T /usr/lib/locale/af_ZA/LC_NUMERIC
+ S.5....T /usr/lib/locale/af_ZA/LC_PAPER
+ S.5....T /usr/lib/locale/af_ZA/LC_TELEPHONE
+ S.5....T /usr/lib/locale/af_ZA/LC_TIME
+ SM5....T /usr/lib/locale/ar_BH
+ S.5....T /usr/lib/locale/ar_IQ/LC_COLLATE
+ S.5....T /usr/lib/locale/ar_IQ/LC_CTYPE
+ S.5....T /usr/lib/locale/ar_IQ/LC_IDENTIFICATION
+ S.5....T /usr/lib/locale/ar_IQ/LC_MEASUREMENT
+ S.5....T /usr/lib/locale/ar_IQ/LC_MONETARY
+ S.5....T /usr/lib/locale/ar_IQ/LC_NAME
+ S.5....T /usr/lib/locale/ar_IQ/LC_TELEPHONE
+ SM5....T /usr/lib/locale/ar_MA/LC_MESSAGES
+ SM5....T /usr/lib/locale/ar_OM
+ SM5....T /usr/lib/locale/ar_QA
+ SM5....T /usr/lib/locale/ar_SY/LC_MESSAGES
+ SM5....T /usr/lib/locale/ar_TN
+ SM5....T /usr/lib/locale/ar_YE
+ SM5....T /usr/lib/locale/bg_BG/LC_MESSAGES
+ SM5....T /usr/lib/locale/ca_ES
+ SM5..U.T /usr/lib/locale/ca_ES@euro
+ SM5....T /usr/lib/locale/de_AT/LC_MESSAGES
+ SM5....T /usr/lib/locale/de_AT@euro
+ SM5....T /usr/lib/locale/de_BE
+ SM5....T /usr/lib/locale/de_CH/LC_MESSAGES
+ SM5....T /usr/lib/locale/de_DE
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_ADDRESS
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_COLLATE
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_IDENTIFICATION
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_MEASUREMENT
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_MESSAGES/SYS_LC_MESSAGES
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_MONETARY
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_NAME
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_NUMERIC
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_PAPER
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_TELEPHONE
+ S.5....T /usr/lib/locale/de_DE.utf8/LC_TIME
+ SM5....T /usr/lib/locale/de_DE@euro/LC_MESSAGES
+ SM5....T /usr/lib/locale/de_LU
+ SM5....T /usr/lib/locale/de_LU@euro
+ SM5....T /usr/lib/locale/en_AU/LC_MESSAGES
+ SM5....T /usr/lib/locale/en_BW
+ SM5....T /usr/lib/locale/en_CA/LC_MESSAGES
+ SM5....T /usr/lib/locale/en_DK
+ S.5....T /usr/lib/locale/en_GB/LC_MONETARY
+ S.5....T /usr/lib/locale/en_GB/LC_NAME
+ S.5....T /usr/lib/locale/en_GB/LC_NUMERIC
+ S.5....T /usr/lib/locale/en_GB/LC_TELEPHONE
+ S.5....T /usr/lib/locale/en_GB/LC_TIME
+ SM5....T /usr/lib/locale/en_IE/LC_MESSAGES
+ SM5....T /usr/lib/locale/en_IE@euro
+ SM5....T /usr/lib/locale/en_NZ
+ SM5....T /usr/lib/locale/en_US
+ SM5....T /usr/lib/locale/en_US.utf8
+ SM5....T /usr/lib/locale/en_ZA/LC_MESSAGES
+ SM5....T /usr/lib/locale/en_ZW
+ SM5....T /usr/lib/locale/es_AR/LC_MESSAGES
+ SM5....T /usr/lib/locale/es_BO
+ SM5....T /usr/lib/locale/es_CL
+ SM5....T /usr/lib/locale/es_CR/LC_MESSAGES
+ SM5....T /usr/lib/locale/es_EC
+ SM5....T /usr/lib/locale/es_ES
+ SM5....T /usr/lib/locale/es_HN/LC_MESSAGES
+ SM5....T /usr/lib/locale/es_MX
+ SM5....T /usr/lib/locale/es_NI
+ SM5....T /usr/lib/locale/es_PA
+ SM5....T /usr/lib/locale/es_PR/LC_MESSAGES
+ SM5....T /usr/lib/locale/es_PY/LC_MESSAGES
+ SM5....T /usr/lib/locale/es_SV
+ SM5....T /usr/lib/locale/es_US
+ SM5....T /usr/lib/locale/es_UY
+ SM5....T /usr/lib/locale/eu_ES/LC_MESSAGES
+ SM5....T /usr/lib/locale/eu_ES@euro
+ SM5....T /usr/lib/locale/fa_IR.utf8
+ S.5....T /usr/lib/locale/fi_FI/LC_MESSAGES/SYS_LC_MESSAGES
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_ADDRESS
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_COLLATE
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_CTYPE
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_IDENTIFICATION
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_MEASUREMENT
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_MESSAGES/SYS_LC_MESSAGES
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_MONETARY
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_NAME
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_NUMERIC
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_PAPER
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_TELEPHONE
+ S.5....T /usr/lib/locale/fi_FI@euro/LC_TIME
+ SM5....T /usr/lib/locale/fr_BE
+ SM5....T /usr/lib/locale/fr_CA/LC_MESSAGES
+ SM5....T /usr/lib/locale/fr_CH
+ SM5....T /usr/lib/locale/fr_FR/LC_MESSAGES
+ SM5....T /usr/lib/locale/fr_LU
+ SM5....T /usr/lib/locale/ga_IE/LC_MESSAGES
+ SM5....T /usr/lib/locale/ga_IE@euro
+ SM5....T /usr/lib/locale/he_IL
+ SM5....T /usr/lib/locale/id_ID
+ SM5....T /usr/lib/locale/it_CH/LC_MESSAGES
+ SM5....T /usr/lib/locale/it_IT
+ SM5....T /usr/lib/locale/it_IT@euro
+ SM5....T /usr/lib/locale/iw_IL
+ SM5....T /usr/lib/locale/ko_KR.euckr/LC_MESSAGES
+ SM5....T /usr/lib/locale/ko_KR.utf8
+ SM5....T /usr/lib/locale/kw_GB
+ SM5....T /usr/lib/locale/lt_LT
+ SM5....T /usr/lib/locale/lv_LV/LC_MESSAGES
+ SM5....T /usr/lib/locale/mk_MK/LC_MESSAGES
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_ADDRESS
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_COLLATE
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_IDENTIFICATION
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_MEASUREMENT
+ SM5....T /usr/lib/locale/mr_IN.utf8/LC_MESSAGES
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_MONETARY
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_NAME
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_NUMERIC
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_PAPER
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_TELEPHONE
+ S.5....T /usr/lib/locale/mr_IN.utf8/LC_TIME
+ SM5....T /usr/lib/locale/mt_MT
+ SM5....T /usr/lib/locale/nl_BE@euro/LC_MESSAGES
+ SM5....T /usr/lib/locale/nl_NL
+ SM5....T /usr/lib/locale/nl_NL@euro/LC_MESSAGES
+ SM5....T /usr/lib/locale/nn_NO/LC_MESSAGES
+ SM5....T /usr/lib/locale/no_NO
+ SM5....T /usr/lib/locale/pl_PL
+ S.5....T /usr/lib/locale/pt_BR/LC_MESSAGES/SYS_LC_MESSAGES
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_COLLATE
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_IDENTIFICATION
+ SM5....T /usr/lib/locale/pt_PT@euro/LC_MESSAGES
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_MONETARY
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_NAME
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_NUMERIC
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_PAPER
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_TELEPHONE
+ S.5....T /usr/lib/locale/pt_PT@euro/LC_TIME
+ SM5....T /usr/lib/locale/ru_RU.koi8r/LC_MESSAGES
+ SM5....T /usr/lib/locale/ru_RU.utf8
+ SM5....T /usr/lib/locale/ru_UA/LC_MESSAGES
+ SM5....T /usr/lib/locale/sl_SI
+ SM5....T /usr/lib/locale/sv_FI
+ SM5....T /usr/lib/locale/sv_SE
+ SM5....T /usr/lib/locale/uk_UA/LC_MESSAGES
+ SM5....T /usr/lib/locale/vi_VN.utf8
+ SM5....T /usr/lib/locale/zh_CN
+ SM5....T /usr/lib/locale/zh_CN.utf8
+ SM5....T /usr/lib/locale/zh_TW
+ SM5....T /usr/lib/locale/zh_TW.utf8
+ S.5....T /usr/share/locale/it/LC_MESSAGES/libc.mo
+ S.5....T /usr/share/locale/nl/LC_MESSAGES/libc.mo
+ SM5....T /usr/lib/zoneinfo
+ SM5....T /usr/share/zoneinfo
The following devices were added:
+ ++ /var/lib/secchk/data/devices.new Sun Oct 6 23:15:02 2002
+ brw-rw---- root disk 49, 79
/usr/lib/locale/es_DO/LC_MESSAGES
+ brw-rw---- root disk 49, 77
/usr/lib/locale/mr_IN.utf8/LC_CTYPE/LC_TELEPHONE
+ brw-rw---- root disk 49, 78
/usr/lib/locale/mr_IN.utf8/LC_CTYPE/LC_TIME
---schnapp---
The box is running SuSE 7.1 and masquerading our small LAN on an
isdn multilink (ibod) DOD dial-up.
netstat -tulpen shows:
---cut---
tcp 0 0 0.0.0.0:8081 0.0.0.0:*
LISTEN 30 2152897 14411/wwwoffled
tcp 0 0 0.0.0.0:8080 0.0.0.0:*
LISTEN 30 2152896 14411/wwwoffled
tcp 0 0 10.0.0.5:53 0.0.0.0:*
LISTEN 0 2054547 28677/named
tcp 0 0 127.0.0.1:53 0.0.0.0:*
LISTEN 0 2054545 28677/named
tcp 0 0 0.0.0.0:6050 0.0.0.0:*
LISTEN 0 1171726 27331/ibod
tcp 0 0 0.0.0.0:20011 0.0.0.0:*
LISTEN 0 1171577 27132/isdnlog
tcp 0 0 :::22 :::*
LISTEN 0 1171609 27231/sshd
udp 0 0 0.0.0.0:2105 0.0.0.0:*
0 2054548 28677/named
udp 0 0 10.0.0.5:53 0.0.0.0:*
0 2054546 28677/named
udp 0 0 127.0.0.1:53 0.0.0.0:*
0 2054544 28677/named
udp 0 0 0.0.0.0:67 0.0.0.0:*
0 1171701 27317/dhcpd
---schnapp---
ports < 1024 are closed by ipchains for external use. 8080,8081,6050
and 20011, too. Just 2105 udp is open.
Chkrootkit did not claim anything except
/usr/lib/perl5/5.6.0/i586-linux/.pcklist, however I think this is
quite common.
I checked the logs, but did not found anything suspicious. The files
mentioned above are corrupted. Files in /etc/init.d/gpm or idedma,
however, they are no longer executable. Even more strange
/usr/src/linux-2.2.19.SuSE is a binary,too, and in this case it is
world executable.
I hoped dial-up gives some extra security, so I break some basic sec
rules (compiler on the box etc.) but it seems that this was a
personal error :(. However, since the logs did not show anything
suspicious, I am not totaly sure, that it was a break in or some mad
running script :(.
Any idea on this topic greatly appreciated.
TIA
BTW: Sorry, for this long mail, since I am not sure what will be of
assistance I prefered not to cut the logs.
--
Maik