From owner-freebsd-security  Wed Aug  5 14:40:01 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id OAA28309
          for freebsd-security-outgoing; Wed, 5 Aug 1998 14:40:01 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from lariat.lariat.org ([206.100.185.2])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id OAA28266
          for <security@freebsd.org>; Wed, 5 Aug 1998 14:39:55 -0700 (PDT)
          (envelope-from brett@lariat.org)
Received: (from brett@localhost)
	by lariat.lariat.org (8.8.8/8.8.6) id PAA01240;
	Wed, 5 Aug 1998 15:39:30 -0600 (MDT)
Message-Id: <199808052139.PAA01240@lariat.lariat.org>
X-Sender: brett@mail.lariat.org
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.1 
Date: Wed, 05 Aug 1998 15:39:06 -0600
To: security@FreeBSD.ORG
From: Brett Glass <brett@lariat.org>
Subject: Changes to restore and rrestore
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

As mentioned in an earlier message, our daily security "diff" reports that
the dates and times on /sbin/rrestore and /sbin/restore have mysteriously
changed. The new dates are approximately the time when we had a system
crash and had to run fsck.

Could it be that fsck, when it repairs directories, changes dates? Or have
we been hacked again, despite replacing the whole OS and bringing back only
data files?

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message