Home / server / Questions / 203730
Accepted
Eureka Ikara
Asked: 2010-11-19 17:07:28 +0800 CST

OSSEC integrity checksum alert - what caused the change?

  • 772

Recently installed OSSEC on Linux machine to test.

Most results are expected, however yesterday I received emails with a number of notifications about Integrity checksum changing on files such as /usr/bin/whoami /usr/bin/md5sum /usr/bin/ls and about another 50 similar files

Since I didn't install any new versions of these files, how do I find out what caused the integrity checksum to change 2 days after I installed the OSSEC program?

Eureka

linux ossec

1 Answers

  1. Best Answer

    Two reasons are:

    • You've actually been hacked
    • Prelinking is enabled

    You can disable prelinking by editing /etc/sysconfig/prelink from:

    PRELINKING=yes

    to:

    PRELINKING=no

    And running:

    prelink -ua

    Source: http://www.ossec.net/wiki/Know_How:Check_Sums

    • 6