I'm not too sure why the paste didnt work.. I'll try again using plain text: Hello all, Ive got SuSE 6.1 running on one of my machines and awhile back, i downloaded Marc's security crons.. just recently, i received an email that showed "The following programs have got a new suid and/or sgid bit:" basically, every suid program has a new bit.. here's a snippet.. --- snip --- - -rwsr-xr-x 1 root tty 135501 Dec 3 02:07 /opt/kde/bin/kvt - -rwsr-xr-x 1 root root 6220 Dec 3 02:07 /opt/kde/bin/kcheckpass - -r-sr-sr-x 1 root root 374852 Dec 2 01:53 /usr/sbin/sendmail - -rwsr-xr-x 1 man root 70028 Dec 2 01:46 /usr/bin/man - -rwsr-xr-x 1 root root 25052 Dec 2 01:46 /usr/bin/crontab --- snip --- + -rwsr-xr-x 1 root tty 135501 Dec 3 1999 /opt/kde/bin/kvt + -rwsr-xr-x 1 root root 6220 Dec 3 1999 /opt/kde/bin/kcheckpass + -r-sr-sr-x 1 root root 374852 Dec 2 1999 /usr/sbin/sendmail + -rwsr-xr-x 1 man root 70028 Dec 2 1999 /usr/bin/man + -rwsr-xr-x 1 root root 25052 Dec 2 1999 /usr/bin/crontab --- snip --- The machine was up since Dec 2.. and was recently moved and had to be rebooted... the only thing that really changed was a kernel update that took effect after the boot.. would a kernel update cause the above changes? Thanks, Chrissy
On Tue, 6 Jun 2000, Chrissy wrote:
I'm not too sure why the paste didnt work.. I'll try again using plain text:
Hello all, Ive got SuSE 6.1 running on one of my machines and awhile back, i downloaded Marc's security crons.. just recently, i received an email that showed "The following programs have got a new suid and/or sgid bit:" basically, every suid program has a new bit.. here's a snippet.. --- snip --- - -rwsr-xr-x 1 root tty 135501 Dec 3 02:07 /opt/kde/bin/kvt - -rwsr-xr-x 1 root root 6220 Dec 3 02:07 /opt/kde/bin/kcheckpass - -r-sr-sr-x 1 root root 374852 Dec 2 01:53 /usr/sbin/sendmail - -rwsr-xr-x 1 man root 70028 Dec 2 01:46 /usr/bin/man - -rwsr-xr-x 1 root root 25052 Dec 2 01:46 /usr/bin/crontab --- snip --- + -rwsr-xr-x 1 root tty 135501 Dec 3 1999 /opt/kde/bin/kvt + -rwsr-xr-x 1 root root 6220 Dec 3 1999 /opt/kde/bin/kcheckpass + -r-sr-sr-x 1 root root 374852 Dec 2 1999 /usr/sbin/sendmail + -rwsr-xr-x 1 man root 70028 Dec 2 1999 /usr/bin/man + -rwsr-xr-x 1 root root 25052 Dec 2 1999 /usr/bin/crontab --- snip --- The script uses "ls" to get file information and after 6 months ls also incorporates the year "1999" thats what changed.
will happen only once, but one should read it more carefully as the reports are there to be read. yours -- BINGO: robust product evolution capitalizing pure play synergy --- Engelbert Gruber --- SSG Fintl,Gruber,Lassnig nic-hdl: EG2803-RIPE A6140 Telfs Untermarkt 9 Tel. ++43-5262-64727 ---
On Tue, Jun 06, 2000 at 14:48 -0700, Chrissy wrote:
Ive got SuSE 6.1 running on one of my machines and awhile back, i downloaded Marc's security crons.. just recently, i received an email that showed "The following programs have got a new suid and/or sgid bit:" basically, every suid program has a new bit.. here's a snippet.. --- snip --- - -rwsr-xr-x 1 root tty 135501 Dec 3 02:07 /opt/kde/bin/kvt - -rwsr-xr-x 1 root root 6220 Dec 3 02:07 /opt/kde/bin/kcheckpass - -r-sr-sr-x 1 root root 374852 Dec 2 01:53 /usr/sbin/sendmail - -rwsr-xr-x 1 man root 70028 Dec 2 01:46 /usr/bin/man - -rwsr-xr-x 1 root root 25052 Dec 2 01:46 /usr/bin/crontab --- snip --- + -rwsr-xr-x 1 root tty 135501 Dec 3 1999 /opt/kde/bin/kvt + -rwsr-xr-x 1 root root 6220 Dec 3 1999 /opt/kde/bin/kcheckpass + -r-sr-sr-x 1 root root 374852 Dec 2 1999 /usr/sbin/sendmail + -rwsr-xr-x 1 man root 70028 Dec 2 1999 /usr/bin/man + -rwsr-xr-x 1 root root 25052 Dec 2 1999 /usr/bin/crontab --- snip ---
It's not that anything had changed (regarding filesize or ownership or access rights or timestamps -- content is a completely different matter and seems not to get checked, at least not with the cited criterion). It's just that ls(1) switched displaying format now that the files have an age of more than half a year. This certainly has its motivation in the fact that daytime is less important once the file has been there for several months. virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.
participants (3)
-
Chrissy
-
engelbert.gruber@ssg.co.at
-
Gerhard Sittig