RE: [cobalt-security] Have you been hacked?

["Graeme Fowler" <graeme.fowler@xxxxxxxxxxxxxx>]

All

In order to see what the RPM database expects files to be (size, permissions, datestamp and so on), choose the file you want to check and do:

rpm -qvlif $filename

It will then spit out ALL the contents of the RPM database for that specific package. You might want to grep for the filename too, or you might be overwhelmed :)

On RaQs some binaries have had the setuid/setgid bit removed for security purposes.

Also note that if you have no permissions to read a file (since you're not root, for example) the rpm -V command will *always* spit out more files than you expect. If it can't read them, it cannot md5sum them. If it cannot md5sum them, it can't do the compare. If it can't do the compare... the file doesn't verify and you get the ? mark.

Graeme
-- 
Graeme Fowler
System Administrator
Host Europe Group PLC