From owner-freebsd-security Wed Dec 17 07:40:30 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id HAA19064 for security-outgoing; Wed, 17 Dec 1997 07:40:30 -0800 (PST) (envelope-from owner-freebsd-security) Received: from mbox.tu-graz.ac.at (mbox.tu-graz.ac.at [129.27.2.6]) by hub.freebsd.org (8.8.7/8.8.7) with SMTP id HAA19049 for ; Wed, 17 Dec 1997 07:40:24 -0800 (PST) (envelope-from dada@localhost.tu-graz.ac.at) Received: from fcggsg07.icg.tu-graz.ac.at by mbox.tu-graz.ac.at with SMTP id AA05651 (5.67c/IDA-1.5t for ); Wed, 17 Dec 1997 16:40:39 +0100 Received: from localhost.tu-graz.ac.at (isdn095.tu-graz.ac.at [129.27.240.95]) by fcggsg07.icg.tu-graz.ac.at (8.8.8/8.8.8) with ESMTP id QAA07664; Wed, 17 Dec 1997 16:39:39 +0100 (MET) Received: from localhost (localhost.tu-graz.ac.at [127.0.0.1]) by localhost.tu-graz.ac.at (8.8.5/8.8.5) with SMTP id IAA02240; Wed, 17 Dec 1997 08:05:02 +0100 (CET) Date: Wed, 17 Dec 1997 08:05:02 +0100 (CET) From: Martin Kammerhofer Reply-To: Martin Kammerhofer To: David Hawkins Cc: freebsd-security@FreeBSD.ORG Subject: Re: Is this something to worry about? In-Reply-To: <199712170222.MAA01090@word.smith.net.au> Message-Id: Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk On Wed, 17 Dec 1997, Mike Smith wrote: > > > > That the last three files there were modified today. I'm not aware of > > anything on the system that would have modified 'tail' at 5am. > > This is a "feature" of the system; occasionally executables appear to > be written to while they're running. Nobody has been able to work out > why; the write doesn't appear to change any of the actual contents of > the file. > > mike > And it breaks things like tripwire ;-I