Re: IDS detected smbpasswd modified

[Albert Dorofeev <albert.dorofeev@eu.sony.com>]

Mirco Bauer wrote:
> On Mon, 2005-07-18 at 15:29 +0200, Albert Dorofeev wrote:
> 
>>Does anyone have any idea why the ctime would change
>>so often for a file that is essentially not changing
>>in any way, especially not the attributes?
> 
> it's changing, the computer passwords are updated by the windows boxes
> regularly also applied when a user changes his password, so tell the IDS
> to ignore the ctime flag for that file.

If the passwords change, the contents of the file smbpasswd
changes. IIRC, that means the mtime changes. Now, even if
that is not the case, I am perfectly sure the passwords were
not changed by users. The ctime is related to the change
of the attributes of the file. Why would attributes change
and how can I find out what changes them? I understand
that it is most likely smb daemon but this is a strange
behaviour to say the least:

ctime_new=<[2005-07-18T09:44:55]>
ctime_new=<[2005-07-18T14:53:10]>
ctime_new=<[2005-07-18T18:00:00]>
ctime_new=<[2005-07-18T22:00:00]>
ctime_new=<[2005-07-19T02:00:00]>
ctime_new=<[2005-07-19T06:00:00]>

It seems to have settled into a pattern of updating the
attributes every 4 hours. What gives?

Albert