On 2024-06-07, Why 42? The lists account. <li...@y42.org> wrote: > > I noticed this email message this morning: >> Subject: mjoelnir.fritz.box daily insecurity output >> From: "Charlie Root @ mjoelnir_aa1667" ... >> To: ... >> Date: Fri, 07 Jun 2024 01:32:17 +0200 (CEST) >> >> >> Running security(8): >> >> Setuid changes: >> -r-x--s--x 1 root _sshagnt 435040 May 20 14:18:15 2024 /usr/bin/ssh-agent >> -r-x--s--x 1 root _sshagnt 435040 Jun 6 12:07:27 2024 /usr/bin/ssh-agent > > It's true: > mjoelnir:2024 7.06 14:00:57 % stat -x /usr/bin/ssh-agent > File: "/usr/bin/ssh-agent" > Size: 435040 FileType: Regular File > Mode: (2511/-r-x--s--x) Uid: ( 0/ root) Gid: ( 34/_sshagnt) > Device: 4,21 Inode: 156169 Links: 1 > Access: Fri Jun 7 01:30:01 2024 > Modify: Thu Jun 6 12:07:27 2024 > Change: Thu Jun 6 12:07:27 2024 > > mjoelnir:2024 7.06 16:10:01 % ls -ltra /usr/bin | tail > -r-xr-xr-x 1 root bin 191200 May 19 23:41 info* > -r-xr-xr-x 1 root bin 24000 May 19 23:41 infokey* > -r-xr-xr-x 1 root bin 281960 May 19 23:41 makeinfo* > -r-xr-xr-x 1 root bin 31568 May 19 23:41 install-info* > -r-xr-xr-x 1 root bin 30560 May 19 23:41 texindex* > -r-xr-xr-x 1 root bin 28070 May 19 23:41 texi2dvi* > -r-xr-xr-x 1 root bin 665 May 19 23:41 texi2pdf* > drwxr-xr-x 16 root wheel 512 May 20 00:31 ../ > -r-x--s--x 1 root _sshagnt 435040 Jun 6 12:07 ssh-agent* > drwxr-xr-x 2 root wheel 6144 Jun 6 12:07 ./ > > Is that not a bit weird? Why would ssh-agent have changed / been > "touched"? Maybe that's when I booted the system ... Does it make sense > that starting an executable would cause its mtime to be set?
grep ssh-agent /etc/rc > Just wondering ... > > Cheers, > Robb. > > -- Please keep replies on the mailing list.
