Re: Possible tirpwire false alarm?

[<ksemat () wawa eahd or ug>]

Well chkrootkit from http://www.chkrootkit.org and run it on your machine.
I am also slightly confused here:
<quote>
> has been changed. Again the new changes shows no differences in md5sum on any
> of the 3 linux boxes here. One of which is a trusted fresh install.
</quote>

Are you saying that
a) There are no differences between the MD5sums on the new installs and
yours or that
b) There are differences between the new installs and your linux box?

Also have you looked in your logs like lastlog,messages etc. A good
cracker would have cleaned these up but you never know. What version of
bind  and other software that is open are you running?

Noah.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com