From owner-freebsd-security  Sat May  4 15:23:36 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id PAA06257
          for security-outgoing; Sat, 4 May 1996 15:23:36 -0700 (PDT)
Received: from groovy.dreaming.org (groovy.dreaming.org [204.92.5.69])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id PAA06252
          for <freebsd-security@FreeBSD.ORG>; Sat, 4 May 1996 15:23:30 -0700 (PDT)
Received: (from batsy@localhost) by groovy.dreaming.org (8.6.12/8.6.12) id SAA07235; Sat, 4 May 1996 18:31:10 -0400
Date: Sat, 4 May 1996 18:31:10 -0400 (EDT)
From: jamie <batsy@groovy.dreaming.org>
X-Sender: batsy@groovy.dreaming.org
To: Brian Wang <brian@mail.vividnet.com>
cc: freebsd-security@FreeBSD.ORG
Subject: Re: Weird system security output
In-Reply-To: <Pine.BSF.3.91.960504115115.9617A-100000@taurus.vividnet.com>
Message-ID: <Pine.BSF.3.91.960504182917.7227A-100000@groovy.dreaming.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> 	Just last night, I'm having the same problem described above again
> (It occured couple of times before).  Somehow, the date stamp gets altered
> for no reason...a compromised system?  Again, checking the binary file
> from the backup/cdrom yielded nothing.  The following is a nightly
> security check output from one of our server.  Is there a rational
> explanation for this?  Thanks in advance for any help/answer!


I have had this happen and have rationalized it, but I'm not sure if it 
is a cause. I always thought that it was because of the sup process 
adding new files and updating current ones. If I'm dead wrong please 
correct me.


			   I am the walrus.	
		       batsy@groovy.dreaming.org
			www.groovy.dreaming.org