23 Sep
2003
23 Sep
'03
7:22 p.m.
Hi All,
I'm running Mandrake 9.0 on my web server/e-mail server/firewall and MSEC is sending me reports every night telling me what's going on. The thing I find confusing is that I keep getting reports like this:-
Security Warning: These files belonging to packages have changed of status on the system : - No longer modified : /usr/include/c++/3.2/bits/istream.tcc
The thing is, this file has never been modified and it hasn't been modified back. What does it mean by "no longer modified"?
It'll tell me one night that a file has been modified and then the next night it'll tell me that it is no longer modified. With all this "crying wolf" how do I, as a sysadmin, tell when something has really been modified?
Matt