Wire tripped

[Bill Perkins]

jludwig wrote:
> On Thursday 06 October 2005 08:58, Scot L. Harris wrote:
> 
>>On Thu, 2005-10-06 at 08:45, Bill Perkins wrote:
>>
>>>>I believe you can use rpm to validate the files on your system.  rpm is
>>>>prelink aware.  Check the verify option of rpm.  If that shows things
>>>>don't match up then you have a system that may have been compromised.
>>>
>>>I'll take a look into that. What is 'prelink'?
>>>
>>>
>>>Most are executables, some libraries as well (in /usr/lib, openoffice, a
>>>bunch of others).
>>
>>Prelink is used to modify ELF shared libraries and ELF dynamiclly linked
>>binaries to reduce startup time.  Check out the man page for prelink to
>>get more details.
>>
>>The changes you describe are consistent with prelink.

Yes- after perusing the man page, that makes some sense. However, where 
did prelink get triggered from? I sure didn't run it.

> You could try something like;
> -->  rpm -vV -a > /root/rpm_verify 
> Then try less the file /root/rpm_verify.

Cool! I've had it running for a few hours now (this is a 1GHz PIII of 
some sort, with 256M RAM, so it's not the fastest processor on the 
block), and the output looks reasonable so far. I've just switched to 
FC4 from Slackware, and I don't know all the ins and outs of rpm, yum, 
and up2date, so even though I've been using Linux for 10 years now, I'm 
still on a learning curve (which is why I jumped to Linux in the first 
place). Thanks for all the help, I'll let you know what I find.

-- 
-------------------------------------------------------------------------------
"The two most common things in the	| Bill Perkins
  universe are Hydrogen and Stupidity."	| perk at iag.net
					| programmer-at-large
		F. Zappa		| ALL assembly languages done here.
-------------------------------------------------------------------------------