| View previous topic :: View next topic |
| Author |
Message |
dman777
Veteran
Joined: 10 Jan 2007
Posts: 1004
|
 Posted: Sat May 14, 2011 7:01 am Post subject: Worried about AIDE results |
 |
|
5 days ago I tried an experiment. I currently run a music server called Subsonic that runs in a Java machine. My expirement was to make a chroot jail for it. So created a dir /subsonic and copied -a /lib64 and some /usr/bin/ and /bin files into it the chroot directory. The experiment failed so I deleted that chroot directory.
Since then I rested my passwords.
Today I ran AIDE check(I keep the aide bin and aide database on a seperate usb key for security) and what can be found on the attached file.
I what I am worried about most is /lib64 and /usr/bin. Have they been exploited? Why would the modification or ctime be modified just from copying them to another dir?
| Code: | AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2011-05-13 18:28:02
Summary:
Total number of files: 329006
Added files: 82
Removed files: 75
Changed files: 984
Directory: /lib64/rc
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
File: /lib64/rc/cache/depconfig
Ctime : 2011-05-08 23:49:29 , 2011-05-12 09:04:24
File: /lib64/rc/cache/deptree
Ctime : 2011-05-08 23:49:29 , 2011-05-12 09:04:24
File: /lib64/rc/cache/nettree
Ctime : 2011-05-08 23:49:29 , 2011-05-12 09:04:24
File: /lib64/rc/cache/softlevel
Mtime : 2011-05-08 23:49:27 , 2011-05-12 09:04:22
Ctime : 2011-05-08 23:49:29 , 2011-05-12 09:04:24
Directory: /lib64/rc/console
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
File: /lib64/rc/console/default8x16.psfu.gz
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
File: /lib64/rc/console/font
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
File: /lib64/rc/console/keymap
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Directory: /lib64/rc/init.d
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Directory: /lib64/rc/init.d/daemons
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Directory: /lib64/rc/init.d/daemons/autofs
Mtime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Ctime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Inode : 3530 , 3525
File: /lib64/rc/init.d/daemons/autofs/001
Mtime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Ctime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Inode : 3531 , 3526
Directory: /lib64/rc/init.d/daemons/rsyslog
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3366 , 3361
File: /lib64/rc/init.d/daemons/rsyslog/001
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3367 , 3362
Directory: /lib64/rc/init.d/daemons/udev
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
File: /lib64/rc/init.d/daemons/udev/001
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Directory: /lib64/rc/init.d/daemons/vixie-cron
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 6004 , 6000
File: /lib64/rc/init.d/daemons/vixie-cron/001
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 6005 , 6001
File: /lib64/rc/init.d/depconfig
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
File: /lib64/rc/init.d/deptree
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/exclusive
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
File: /lib64/rc/init.d/exclusive/local
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 6010 , 6006
Directory: /lib64/rc/init.d/failed
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/hotplugged
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/inactive
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
File: /lib64/rc/init.d/nettree
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/options
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/rc.starting
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3289 , 3281
Directory: /lib64/rc/init.d/scheduled
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
File: /lib64/rc/init.d/softlevel
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Directory: /lib64/rc/init.d/started
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Link: /lib64/rc/init.d/started/anacron
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3384 , 3379
Link: /lib64/rc/init.d/started/autofs
Mtime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Ctime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Inode : 3533 , 3528
Link: /lib64/rc/init.d/started/bootmisc
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2964 , 2955
Link: /lib64/rc/init.d/started/consolefont
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3082 , 3074
Link: /lib64/rc/init.d/started/devfs
Mtime : 2011-05-08 20:50:50 , 2011-05-12 12:15:43
Ctime : 2011-05-08 20:50:50 , 2011-05-12 12:15:43
Inode : 2687 , 2678
Link: /lib64/rc/init.d/started/dmcrypt
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2794 , 2785
Link: /lib64/rc/init.d/started/dmesg
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Link: /lib64/rc/init.d/started/fsck
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2853 , 2844
Link: /lib64/rc/init.d/started/hostname
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3093 , 3085
Link: /lib64/rc/init.d/started/hwclock
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2706 , 2697
Link: /lib64/rc/init.d/started/keymaps
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3117 , 3109
Link: /lib64/rc/init.d/started/localmount
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2903 , 2894
Link: /lib64/rc/init.d/started/lvm
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2830 , 2821
Link: /lib64/rc/init.d/started/modules
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2782 , 2773
Link: /lib64/rc/init.d/started/mtab
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2884 , 2875
Link: /lib64/rc/init.d/started/net.eth0
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3476 , 3471
Link: /lib64/rc/init.d/started/net.lo
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3202 , 3194
Link: /lib64/rc/init.d/started/netmount
Mtime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Ctime : 2011-05-09 01:50:53 , 2011-05-12 17:15:46
Inode : 3553 , 3548
Link: /lib64/rc/init.d/started/procfs
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3257 , 3249
Link: /lib64/rc/init.d/started/root
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2871 , 2862
Link: /lib64/rc/init.d/started/rsyslog
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3369 , 3364
Link: /lib64/rc/init.d/started/shorewall
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 5958 , 5954
Link: /lib64/rc/init.d/started/swap
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3268 , 3260
Link: /lib64/rc/init.d/started/sysctl
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 2928 , 2919
Link: /lib64/rc/init.d/started/sysfs
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Link: /lib64/rc/init.d/started/termencoding
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3052 , 3044
Link: /lib64/rc/init.d/started/udev
Mtime : 2011-05-08 20:50:50 , 2011-05-12 12:15:43
Ctime : 2011-05-08 20:50:50 , 2011-05-12 12:15:43
Inode : 2667 , 2658
Link: /lib64/rc/init.d/started/udev-mount
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:42
Link: /lib64/rc/init.d/started/udev-postmount
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 5982 , 5978
Link: /lib64/rc/init.d/started/urandom
Mtime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Ctime : 2011-05-09 01:50:52 , 2011-05-12 17:15:45
Inode : 3283 , 3275
Link: /lib64/rc/init.d/started/vixie-cron
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 6009 , 6005
Directory: /lib64/rc/init.d/starting
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Link: /lib64/rc/init.d/starting/local
Mtime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Ctime : 2011-05-09 01:50:56 , 2011-05-12 17:15:49
Inode : 6013 , 6009
Directory: /lib64/rc/init.d/stopping
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/tmp
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /lib64/rc/init.d/wasinactive
Mtime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Ctime : 2011-05-08 20:50:49 , 2011-05-12 12:15:41
Directory: /usr/bin
Mtime : 2011-05-09 08:55:24 , 2011-05-09 09:05:51
Ctime : 2011-05-09 08:55:24 , 2011-05-09 09:05:51
File: /usr/share/man/whatis
Mtime : 2011-05-09 04:02:01 , 2011-05-13 04:02:02
Ctime : 2011-05-09 04:02:01 , 2011-05-13 04:02:02
|
|
|
| Back to top |
|
 |
phajdan.jr
Retired Dev
Joined: 23 Mar 2006
Posts: 1777
Location: Poland
|
| Posted: Sat May 14, 2011 9:55 am Post subject: |
|
|
I think it's just rc (init) system's state and cache info, and periodically regenerated whatis database. It should be possible to adjust your AIDE configuration not to raise alarm for those files.
_________________
http://phajdan-jr.blogspot.com/ |
|
| Back to top |
|
|
dman777
Veteran
Joined: 10 Jan 2007
Posts: 1004
|
| Posted: Mon May 16, 2011 2:45 am Post subject: |
|
|
| For learning purposes, can you please explain to me when/why the /lib64 and the files in the dir gets used to where the mtime and ctime are modified? Not talking about dureing a emerge update....seems to be a regular occurrence that the state of /lib64 changes but I am curious about the process that does this. |
|
| Back to top |
|
|
Etal
Veteran
Joined: 15 Jul 2005
Posts: 1932
|
| Posted: Mon May 16, 2011 3:46 am Post subject: |
|
|
/lib64/rc/init.d is on a tmpfs filesystem, mounted at boot:
| Code: | $ mount | grep /lib64/
rc-svcdir on /lib64/rc/init.d type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755) |
... so it gets changed every bootup.
/lib64/rc/cache is written to by /etc/init.d/savecache, which is run at shutdown.
| Code: | $ grep -RnA2 depconfig /etc/init.d/
/etc/init.d/savecache:30: for x in deptree depconfig shutdowntime softlevel nettree rc.log; do
/etc/init.d/savecache-31- [ -e "$RC_SVCDIR/$x" ] && save="$save $RC_SVCDIR/$x"
/etc/init.d/savecache-32- done |
/lib64/rc/console is modified by termancoding, consolefont, bootmisc, and keymaps services:
| Code: | $ grep -Rn /console/ /etc/init.d/
/etc/init.d/termencoding:41: echo "" > "$RC_LIBEXECDIR"/console/unicode
/etc/init.d/termencoding:43: rm -f "$RC_LIBEXECDIR"/console/unicode
/etc/init.d/consolefont:63: echo "${font##*/}" >"$RC_LIBEXECDIR"/console/font
/etc/init.d/bootmisc:29: rm -rf "$RC_LIBEXECDIR"/console/*
/etc/init.d/keymaps:68: dumpkeys >"$RC_LIBEXECDIR"/console/keymap |
Hope that helps 
_________________
“And even in authoritarian countries, information networks are helping people discover new facts and making governments more accountable.”– Hillary Clinton, Jan. 21, 2010 |
|
| Back to top |
|
|
dman777
Veteran
Joined: 10 Jan 2007
Posts: 1004
|
| Posted: Mon May 16, 2011 5:09 am Post subject: |
|
|
| Wow, that helps alot....thanks! Question... in this case /lib64 resides in tmpfs. In a chroot filesystem is that same /lib64 shared in tmps or is there a piece of tmpfs partitioned off for for the chroot filesystem? |
|
| Back to top |
|
|
Etal
Veteran
Joined: 15 Jul 2005
Posts: 1932
|
| Posted: Mon May 16, 2011 6:37 pm Post subject: |
|
|
You don't boot a chroot, so the chroot is not going to start any system services (which is what /lib64/rc/ is for).
(Also, not sure if it's a typo, but /lib64 is not on tmpfs - only /lib64/rc/init.d is)
_________________
“And even in authoritarian countries, information networks are helping people discover new facts and making governments more accountable.”– Hillary Clinton, Jan. 21, 2010 |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
