Charlie Hartill wrote:
> When I use rpm to verify binaries I get the output below.
>
> My question is is there anything special to the e-smith/mitel
> customization which would cause a newbie to get a false
> positive for hacking.
False positives in such tests are common. Writers of security scanners tend to err on the side of caution, and sometimes use simplistic tests to "determine" vulnerability (e.g. version number).
> And what tests would gurus recommend
You've made a good start by using "rpm -Va". You've made a bad start by publishing this information in a public forum. Fortunately, there's nothing to concern you here.
For starters you can probably ignore anything with a "c" column. They are config files, and you expect the size, timestamp and MD5 sum to be different to the file packaged in the rpm.
> [root@AMHURST root]# cat /root/rpm_chk.txt
> .......T /var/qmail/queue/lock/tcpto
That's a working file, and you can expect the timestamp to change.
> ....L.G. c /etc/localtime
glibc puts a file there, we use a symlink to the correct timezone file instead.
> .M...... /etc/rc.d/init.d
That's because the initscripts and chkconfig RPMs disagree about correct mode of that directory. The difference (setgid) shouldn't matter. I've raised a bug report.
> S.5...GT c /var/lib/dhcp/dhcpd.leases
What group owns that file? Probably harmless.
> S.5....T /var/qmail/etc/service/qmail/log/supervise/status
> S.5....T /var/qmail/etc/service/qmail/supervise/status
They're working files, and you expect them to change.
> .M...... /etc/ppp
Same problem with the initscripts RPM.
> S.5...GT c /etc/ppp/chap-secrets
File is owned "daemon", but expected to be "root". No group read/write permission so it doesn't matter.
> SM5...GT c /home/httpd/html/horde/config/horde.php
> SM5...GT c /home/httpd/html/horde/config/mime_drivers.php
> SM5...GT c /home/httpd/html/horde/config/registry.php
Expected by rpm to be 0640, root.www and are 0644, root.root. No security risk since they are expanded from template, so anyone can find our their contents anyway.
> .M...... /home/httpd/html/horde/scripts
> .M...... /home/httpd/html/horde/scripts/db
The rpm expects these to be setgid, but they aren't. Probably an RPM building error, and not a security problem (since the directories are 0755, root.root, i.e. can only be modified by root).
> SM5...GT c /home/httpd/html/horde/turba/config/conf.php
> SM5...GT c /home/httpd/html/horde/turba/config/sources.php
As for horde.php above.
> SM5....T c /etc/ssh/sshd_config
Permissions allow group/world read, which is not advisable. That's our fault, and I've raised a bug. Not critical, since these are standard templates, so it's not a state secret what's in there.
> SM5....T c /etc/ftpusers
We have the opposite problem here. The RPM is generous with read permissions, and we reduce those when we expand the template.
> SM5....T c /etc/proftpd.conf
The expanded template is world readable. It contains no big secrets. I've raised a bug.
> Unsatisfied dependencies for megaide-1.03d-02: kernel =
> 2.2.19-7.0.8
Unused leftover from a 5.5 upgrade. You can fix by doing "rpm -e megaide".
In future, please mail any security concerns to smesecurity@mitel.com, rather than post in a public forum.
Charlie
5 Replies
923 Views