Re: strange AIDE reports

[vegard@engen.priv.no (Vegard Engen)]

On Mon, Sep 24, 2001 at 02:02:49PM +0300, Juha Jäykkä wrote:
>   I keep receiving strange reports from AIDE. The number of changed
> files increases monotonically daily and the affair started immediately
> after installation, so I doubt there has been a break-in - unless
> someone managed to spoof my DNS queries or hijack my connections to
> ftp.fi.debian.org. Aside from the understandable (are they, really?)
> changes in Ctimes of /dev/xconsole and /dev/tty*, I get the following
> (for example):
> File: /usr/bin/splay
> MD5: old = nuNALnPFG98QSxxAeJ2rZw== , new = hBi7I+KhEOWW5mfSciXJlg==
> SHA1: old = 3lpox5dX50hvj3p6z0nyZ/cshFg= , new = mFPQd21+i8fF2LQJVZLitJZFx2U=
> 
> File: /usr/lib/Amaya/applis/bin/amaya
> MD5: old = IQwcW65xdJIoC3/pAh6P8A== , new = 2HG/njXLRrF1GTp7Rd3EVw==
> 
>   The software versions are (all are unstable/i386):

[snip] rest.

>   Any ideas except a break-in?

Well - you say you're using unstable. Are you updating your system? There are
a lot of changes in unstable. After a package replacement, binary files will
of course have changed.
-- 
- Vegard Engen, member of the first RFC1149 implementation team.