[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Could /etc/security be changing the time on setuid files?



Could /etc/security be changing the timestamps and perms on some of my
setuid files?  I'm getting a reports of file time changes from /etc/security
and the new times were corresponding with the 0130 run of /etc/daily. I've
run the script twice this morning and this is the output:

Checking setuid/setgid files and devices:
Setuid changes:
-r-sr-xr-x  1  root  bin   24576  May  13  10:26:56  2002  /usr/bin/su
-r-sr-xr-x  1  root  bin   24576  May  13  10:46:05  2002  /usr/bin/su
-r-sr-xr-x  1  root  auth  16384  May  13  10:26:56  2002  /usr/libexec/auth/login_krb4-or-pwd
-r-sr-xr-x  1  root  auth  16384  May  13  10:46:05  2002  /usr/libexec/auth/login_krb4-or-pwd

The last time was 09:24 on Saturday, when I first looked into the problem 
and ran daily by hand, and before that the time was 01:30:27.

I'm running OpenBSD sparc on a Sparc 2. 

     # uname -a
     OpenBSD sparky 3.0 GENERIC#47 sparc

I've installed a couple of ports but nothing that I think would cause this?

     # pkg_info -aI
     libiconv-1.7       character set conversion library
     screen-3.9.10      multi-screen window manager
     gettext-0.10.40    GNU gettext
     gmake-3.79.1       GNU make
     emacs-20.7         GNU editor
     ntp-4.1.71         network time protocol implementation
     bind-8.2.5         Berkeley Internet Name Daemon
     postfix-20010228.pl08 fast, secure sendmail replacement
     procmail-3.21      filtering local mail delivery agent
     openldap-client-2.0.23 Open source LDAP software (client)
     gdbm-1.8.0         GNU dbm
     courier-imap-1.3.11-ldap imap server for maildir format mailboxes
     courier-pop3-1.3.11-ldap pop3 server for maildir format mailboxes


-- 
Chris Hilton                                 chilton-at-vindaloo-dot-com
------------------------------------------------------------------------
                "All I was doing was trying to get home from work!"
                                                 -- Rosa Parks