From owner-freebsd-security Sun Jan 2 1:23:37 2000 Delivered-To: freebsd-security@freebsd.org Received: from server.research.zopps.fi (ws99.research.zopps.fi [195.165.196.99]) by hub.freebsd.org (Postfix) with ESMTP id A9A2E14C17 for ; Sun, 2 Jan 2000 01:23:23 -0800 (PST) (envelope-from martti@research.zopps.fi) Received: (from uucp@localhost) by server.research.zopps.fi (8.9.3/8.9.3) id LAA33507 for ; Sun, 2 Jan 2000 11:23:14 +0200 (EET) (envelope-from martti.kuparinen) Received: from ws125.research.zopps.fi(195.165.196.125) via SMTP by ws99.research.zopps.fi, id smtpdA33505; Sun Jan 2 11:23:09 2000 Date: Sun, 2 Jan 2000 11:23:09 +0200 (EET) From: Martti Kuparinen To: freebsd-security@freebsd.org Subject: zero checksums in tripwire Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi! I'm using tripwire-1.2 to check the filesystems for modifications. Something weird happened today: ### Phase 5: Generating observed/expected pairs for changed files ### ### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ============================= /usr/sbin/mergemaster snefru (sig2): 0 1YtxO4k.hi8WCaxeN2OeK7 crc32 (sig3): 0 2.CHwf crc16 (sig4): 0 0009Yl md4 (sig5): 0 36WHBVUe1VKbe71GDuAfPx md2 (sig6): 0 1ME7ZPdw3AEDfbiH9EqzQ1 sha (sig7): 0 5GitfGU8C56VXcAZTHHw0IsJJ6W haval (sig8): 0 08FTJNA4mat.Yv8nFwfbkT ---> File: '/usr/sbin/mergemaster' ---> Update entry? [YN(y)nh?] There are several other similar cases where all the checksums are zeros. Any idea what's going on? /Martti To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message