Re: Strange changes - any ideas?

[Andrew.V.Kovalev () jet msk su (Andrew V. Kovalev)]

Fred Cohen wrote:
> We run a change-controlled environment, which means that we should be
> aware of all changes.  To crosscheck this, we regularly do automated
> change detection.  This morning, I made some minor changes to some user
> areas and ran the change control checks only to find the changes listed
> below. (Here are some select extracts)
>
>         *** '/bin/newgrp' has changed as follows:
>            The contents (md5 checksum) changed. Any change in content can trigger this.
> Checking /bin
> *** '/bin/newgrp' has changed as follows:
>    The contents (md5 checksum) changed. Any change in content can trigger this.
> *** '/bin/login' has changed as follows:


Looks like /usr was remounted with nosuid option. All (and only) setuid
executables are listed.

                                avk