On Tue, Aug 12, 2003 at 07:49:47AM -0400, Mehta, Rohit wrote: > > Hi I am configuring tripwire for one of our Debian servers, and am puzzled by some > files > which change modification time during reboot. > > Included are: > /lib/modules/2.2.20-idepci/modules.dep > /lib/modules/2.2.20-idepci/modules.generic_string > ...some other modules... > /lib/modules/2.2.20-idepci/modules.usbmap > > The data (md5 checksum), filesize, inode, etc have all remained static, but the > modification > time has changed on the reboot. I did not update any modules, so I am wondering > what the > issue is here. I certainly would like to know if someone replaces my modules with > evil backdoor > modules. > > Should I be concerned about the updating modification times?
No, it's perfectly normal. Upon rebooting, you see a line 'Calculating module dependencies...' or something like that. The modules* files are regenerated right then. However, if you didn't add any new modules before the reboot, the resultant file is identical to the original file. Hence, no size and md5sum changes. BTW, IIUC, tripwire should warn you about replaced modules. David -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
