Hi All,
I'm running Mandrake 9.0 on my web server/e-mail server/firewall and
MSEC is sending me reports every night telling me what's going on. The
thing I find confusing is that I keep getting reports like this:-
Security Warning: These files belonging to packages have changed of
status on the system :
- No longer modified :
/usr/include/c++/3.2/bits/istream.tcc
The thing is, this file has never been modified and it hasn't been
modified back. What does it mean by "no longer modified"?
It'll tell me one night that a file has been modified and then the next
night it'll tell me that it is no longer modified. With all this "crying
wolf" how do I, as a sysadmin, tell when something has really been
modified?
Matt