topic Re: AIDE (software integrity app) & mtime question in Operating System - Linux

AIDE (software integrity app) & mtime question

Jorge Fabregas — Fri, 18 Jan 2008 15:16:50 GMT

Hello everyone,

We run RHEL4 on our ProLiant BL20p G3 servers and I'm playing-with/evaluatiing AIDE (software integrity app similar to tripwire) in order to install it on some new servers during the next weeks.

I've been tweaking the configuration file and I've been running it for a couple of days. I run the "check" every night but last night I got a warning about 3 directories: they're mtime changed. I'm 100% sure my system wasn't hacked (as it is offline). I just found out that the modification time in these directories is the same as the time the scripts in /etc/cron.daily run. The directories were:

/usr/lib64
/usr/bin
/lib64

Does anyone knows what script on /etc/cron.daily might change mtime in these directories? A script could "touch" these files in order to change the mtime on purpose (don't see why) or a file could be removed or added from these directories (very unlikely). I did a search for new files in these directories but none were found.

I could just remove the check for mtime in these directories but I don't think it would be wise.

Thanks in advance,
Jorge

Re: AIDE (software integrity app) & mtime question

Matti_Kurkela — Tue, 22 Jan 2008 08:01:19 GMT

It's probably "prelink". It adds some information to executables and libraries to speed up loading. Read "man prelink" for a more detailed description.

When using AIDE or tripwire, you'll generally want to run the prelinking manually after each update or software installation, and *only then* acknowledge the changes in the integrity application. Or if your server's workload does not involve starting a lot of processes frequently, you might choose to disable the prelink system.

MK

Re: AIDE (software integrity app) & mtime question

Jorge Fabregas — Wed, 23 Jan 2008 13:43:41 GMT

Thanks Matti. Right on. Prelink was indeed. Thanks also for the tip. I'll do that (run prelink manually after update and THEN recreate the AIDE database).

All the best,
Jorge