[RH List] Re: Possible break-in

[Eric Wood]

From: "Ashley M. Kirchner"
>     Looking at the sizes of some of these binaries, they've all grown:
>
> Original (from RPM)                     Modified
> --------------------------------------------------------------------------
---
> /usr/bin/gs                 3,196,892   /usr/bin/gs
> 3,206,552


Now, this doesn't have anything to do with the "prelink" routine that cron
runs?  Prelink changes file sizes and signitures but I don't know if it
designed to hush up tripwire about these changes.

-eric wood