pellefantus
November 28th, 2012, 02:01 PM
Hello,
I had a webserver at home hosting some misc pages, and in an effort I wanted to strengthen the security so I reinstalled the computer with 12.04.1 LTS.
Then, before allowing the big, bad internet on I installed nginx, node.js, redis, twistd (for hosting my sites) and used apparmor profiling on them. I then installed tripwire and rkhunter.
This is an report from tripwire the day before opening up the site to the internet (inbound HTTP port 80):
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report
Report generated by: root
Report created on: Tue Nov 27 18:32:34 2012
Database last updated on: Tue Nov 27 18:24:46 2012
================================================== =============================
Report Summary:
================================================== =============================
Host name: al
Host IP address: 127.0.1.1
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/al.twd
Command line used: /usr/sbin/tripwire --check --quiet --email-report
================================================== =============================
Rule Summary:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
Other binaries 66 0 0 0
Tripwire Binaries 100 0 0 0
Other libraries 66 0 0 0
Root file-system executables 100 0 0 0
Tripwire Data Files 100 0 0 0
System boot changes 100 0 0 0
Root file-system libraries 100 0 0 0
(/lib)
Critical system boot files 100 0 0 0
Other configuration files 66 0 0 0
(/etc)
Boot Scripts 100 0 0 0
Security Control 66 0 0 0
Root config files 100 0 0 0
Devices & Kernel information 100 0 0 0
(/dev)
Invariant Directories 66 0 0 0
Total objects scanned: 28319
Total violations found: 0
================================================== =============================
Object Detail:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
No violations.
================================================== =============================
Error Report:
================================================== =============================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
And this is what shocked me this morning
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report
Report generated by: root
Report created on: Wed Nov 28 06:54:16 2012
Database last updated on: Tue Nov 27 18:24:46 2012
================================================== =============================
Report Summary:
================================================== =============================
Host name: al
Host IP address: 127.0.1.1
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/al.twd
Command line used: /usr/sbin/tripwire --check --quiet --email-report
================================================== =============================
Rule Summary:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
* Other binaries 66 0 0 86
Tripwire Binaries 100 0 0 0
* Other libraries 66 0 0 32
* Root file-system executables 100 0 0 29
Tripwire Data Files 100 0 0 0
* System boot changes 100 2 0 0
Root file-system libraries 100 0 0 0
(/lib)
Critical system boot files 100 0 0 0
* Other configuration files 66 0 0 8
(/etc)
Boot Scripts 100 0 0 0
Security Control 66 0 0 0
Root config files 100 0 0 0
Devices & Kernel information 100 0 0 0
(/dev)
Invariant Directories 66 0 0 0
Total objects scanned: 28321
Total violations found: 157
================================================== =============================
Object Detail:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Rule Name: Other binaries (/usr/sbin)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 2
----------------------------------------
Modified object name: /usr/sbin
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 16:23:14 2012 Wed Nov 28 06:52:33 2012
Modified object name: /usr/sbin/chroot
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537128 548611
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
-------------------------------------------------------------------------------
Rule Name: Other libraries (/usr/lib)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 32
----------------------------------------
Modified object name: /usr/lib/apt/methods
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:44:35 2012 Wed Nov 28 06:53:04 2012
Modified object name: /usr/lib/apt/methods/bzip2
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526192 537193
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 BgDHXZ A0qJUX
* MD5 BLpj77p6HOvWMceh27u9bk D4n5G6dxJGIl1E3S6PpBD+
Modified object name: /usr/lib/apt/methods/cdrom
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526185 537192
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 A0r8N+ CTOo/R
* MD5 Bc0mhTMMVBm2ZulT5fC8us C+00qZrKfMNLESgjTzV/iP
Modified object name: /usr/lib/apt/methods/copy
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526190 537190
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 CBVO6h AvJbEL
* MD5 C5hZI1GBfIF5O8zvkXLWzp A4Isi2RwIm52AEWgrh1oL9
Modified object name: /usr/lib/apt/methods/file
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526188 537188
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 DPI9tq Ah/RKT
* MD5 CuMNl09Z8c3l5lSYbTpIhV DHBvZAkAAKM53hdFDJmKTO
Modified object name: /usr/lib/apt/methods/ftp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526186 537191
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 A82jMT DWovV0
* MD5 BA8bu1WfFBLhX138yPzXW7 C84juYSJB99vB2lzO/EZ0S
Modified object name: /usr/lib/apt/methods/gpgv
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526183 537194
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 CrACJf BaQfuZ
* MD5 AtQtyBMIUlk7eKwQeuIvh4 AVYilH4ugzNtgNkhMMltvs
Modified object name: /usr/lib/apt/methods/gzip
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526187 537186
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 A7iB0O CHeoDu
* MD5 AQxZOrg1KOFm9X1WkvW2yG DEXdnY08zLfiwF1vEh3vvP
Modified object name: /usr/lib/apt/methods/http
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526189 537189
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 DvGxl4 A0qroy
* MD5 DD3vIq01DL209A5NzYe2Gu D2svHlp5GwqO/1jdgGYXQk
Modified object name: /usr/lib/apt/methods/https
Property: Expected Observed
------------- ----------- -----------
* Inode Number 527003 526112
* Modify Time Mon Oct 15 11:58:40 2012 Mon Nov 19 21:33:19 2012
* CRC32 DpTpJU D7nt/F
* MD5 CkmIudnrAfxvRqGqwdekLI BBLIHITP+4ODpgK7SxbEqF
Modified object name: /usr/lib/apt/methods/lzma
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526202 537203
* Modify Time Mon Oct 15 11:56:14 2012 Mon Nov 19 21:30:36 2012
Modified object name: /usr/lib/apt/methods/mirror
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526191 537196
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 D6kvg0 CKsQvW
* MD5 DKhzLkb0G2tFKPhUAdPzny DQPtkuPg1hBZ4vhkLl2Z6n
Modified object name: /usr/lib/apt/methods/rred
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526182 537187
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 DXeQ8A C9fDKv
* MD5 BWEudDEEABm3bJEek6DUNC B3EZ7v+rKIHqR6nLRLth/k
Modified object name: /usr/lib/apt/methods/rsh
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526184 537195
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 CDscDk C0qB5v
* MD5 Bq+KgSWfqkmbYVWxP1T19Z DKhUPISHCvmpEaD84dBKzs
Modified object name: /usr/lib/apt/methods/ssh
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526205 537205
* Modify Time Mon Oct 15 11:56:14 2012 Mon Nov 19 21:30:36 2012
Modified object name: /usr/lib/apt/methods/xz
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526199 537201
* Modify Time Mon Oct 15 11:56:14 2012 Mon Nov 19 21:30:36 2012
Modified object name: /usr/lib/apt/solvers
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:44:24 2012 Wed Nov 28 06:53:03 2012
Modified object name: /usr/lib/apt/solvers/apt
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526960 526115
* Modify Time Mon Oct 15 11:58:34 2012 Mon Nov 19 21:33:12 2012
Modified object name: /usr/lib/apt/solvers/dump
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526955 526110
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 AEv7gh B3wWHQ
* MD5 BgmxWkLy38aWUuIoSwvKxW BTqsZSQO6aIGv0GqUNem/L
Modified object name: /usr/lib/coreutils
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:41:08 2012 Wed Nov 28 06:52:33 2012
Modified object name: /usr/lib/coreutils/libstdbuf.so
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537129 548612
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/lib/dpkg/methods/apt
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:42:25 2012 Wed Nov 28 06:52:51 2012
Modified object name: /usr/lib/dpkg/methods/apt/desc.apt
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526177 537183
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/install
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526178 537182
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/names
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526180 537185
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/setup
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526179 537184
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/update
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526181 537181
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/i386-linux-gnu
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 17:24:19 2012 Wed Nov 28 06:53:01 2012
Modified object name: /usr/lib/i386-linux-gnu/libapt-inst.so.1.4
Property: Expected Observed
------------- ----------- -----------
* Inode Number 527480 526099
* Modify Time Mon Oct 15 11:56:02 2012 Mon Nov 19 21:30:22 2012
Modified object name: /usr/lib/i386-linux-gnu/libapt-inst.so.1.4.0
Property: Expected Observed
------------- ----------- -----------
* Inode Number 527475 526094
* Modify Time Mon Oct 15 11:58:19 2012 Mon Nov 19 21:32:55 2012
* CRC32 A4liD5 CbzVPL
* MD5 AeSfNMsi7WGU29XLQ7tO/b AQZG47LDVnXwDlsCQp5qPs
Modified object name: /usr/lib/i386-linux-gnu/libapt-pkg.so.4.12
Property: Expected Observed
------------- ----------- -----------
* Inode Number 524252 537103
* Modify Time Mon Oct 15 11:55:58 2012 Mon Nov 19 21:30:18 2012
Modified object name: /usr/lib/i386-linux-gnu/libapt-pkg.so.4.12.0
Property: Expected Observed
------------- ----------- -----------
* Inode Number 524250 537102
* Modify Time Mon Oct 15 11:58:12 2012 Mon Nov 19 21:32:47 2012
* CRC32 DyIMDZ CbFKdc
* MD5 BH8ObpuMXcMBEghoNZ3Vd9 AMLEo282AQDXDqUUOeXbis
-------------------------------------------------------------------------------
Rule Name: Other binaries (/usr/bin)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 84
----------------------------------------
Modified object name: /usr/bin
Property: Expected Observed
------------- ----------- -----------
* Size 24576 28672
* Modify Time Tue Nov 27 17:25:21 2012 Wed Nov 28 06:53:03 2012
* Blocks 56 64
Modified object name: /usr/bin/[
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537107 548590
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/apt-cache
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526055 524207
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 B18SEk C1XklM
* MD5 AGK7D0T787x8dkc94ioWdS B2m7Ch/OC90P6DEsvdNqop
Modified object name: /usr/bin/apt-cdrom
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526051 524209
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 AlJKge CgM/4+
* MD5 DFKmCZlgYoLfYuFvzPVap1 CDz8oCw9Jx2G4IPwFM4b/6
Modified object name: /usr/bin/apt-config
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526049 524203
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 Bb/J86 D7vP0Y
* MD5 DHTCSMZTVf9srULPXEOeNj AogCPFSFHbmhaCcETq8wAC
Modified object name: /usr/bin/apt-extracttemplates
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526932 524756
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 BAwPzN AYOE8k
* MD5 BzQ5W1BDusucs6B+cS7Gvr B4DIAABHtgJ9Y2bIMEXAk8
Modified object name: /usr/bin/apt-ftparchive
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526929 524755
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 CxqL+q C691fQ
* MD5 Ac3xno1dalhvUZY2iTJ3Ed BfbCu8hgGgivPyII+YztEI
Modified object name: /usr/bin/apt-get
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526056 524204
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 ALqMcQ B9AKgs
* MD5 BIwkHAkymj6LcCDXqgAbqF DDD3GPHlUvVcMFy3VQUi9I
Modified object name: /usr/bin/apt-internal-solver
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526930 524757
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 BpP83X DGqjqd
* MD5 D9M4aQcE2NzFcZheW+yxdb DMm+/ZSH18EnuNChENjWRP
Modified object name: /usr/bin/apt-key
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526054 524208
* Modify Time Mon Oct 15 11:56:26 2012 Mon Nov 19 21:30:49 2012
Modified object name: /usr/bin/apt-mark
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526052 524201
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 AGbkDY BpQwN3
* MD5 BrV+AL0hjTQA1VaULoDOYo Ax1IFaWeqMGKJqganKpItU
Modified object name: /usr/bin/apt-sortpkgs
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526931 524754
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:13 2012
* CRC32 B9ID0X CvPujh
* MD5 BfrfCVKjmmShmzbb1QkVIS ALJKgZ+IfylvGA4DZznp4r
Modified object name: /usr/bin/arch
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537124 548607
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/base64
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537093 548576
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/basename
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537058 548541
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/chcon
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537098 548581
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/cksum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537126 548609
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/comm
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537116 548599
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/csplit
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537069 548552
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/cut
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537059 548542
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/dircolors
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537106 548589
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/dirname
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537113 548596
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/du
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537123 548606
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/env
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537084 548567
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/expand
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537065 548548
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/expr
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537076 548559
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/factor
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537111 548594
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/fmt
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537105 548588
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/fold
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537100 548583
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/groups
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537125 548608
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/head
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537082 548565
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/hostid
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537110 548593
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/id
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537102 548585
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/install
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537104 548587
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
* CRC32 AdoZI9 A74Een
* MD5 AxPt7+GPPvMsKkWXC5KxhD As7bfGqdzQG9vEmCK1fTPZ
Modified object name: /usr/bin/join
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537089 548572
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/link
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537066 548549
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/logname
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537092 548575
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/md5sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537088 548571
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/md5sum.textutils
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537239 548722
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:29 2012
Modified object name: /usr/bin/mkfifo
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537087 548570
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nice
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537078 548561
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nl
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537115 548598
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nohup
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537114 548597
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nproc
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537094 548577
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/od
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537077 548560
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/paste
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537090 548573
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/pathchk
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537101 548584
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/pinky
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537096 548579
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/pr
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537060 548543
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/printenv
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537068 548551
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/printf
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537122 548605
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/ptx
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537121 548604
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/runcon
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537075 548558
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/seq
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537072 548555
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha1sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537120 548603
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha224sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537083 548566
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha256sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 530781 548540
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha384sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537063 548546
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha512sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537118 548601
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/shred
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537086 548569
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/shuf
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537074 548557
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sort
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537095 548578
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/split
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537079 548562
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/stat
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537103 548586
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/stdbuf
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537119 548602
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537108 548591
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tac
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537073 548556
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tail
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537091 548574
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tee
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537109 548592
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/test
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537117 548600
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/timeout
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537067 548550
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/touch
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537241 548724
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:29 2012
Modified object name: /usr/bin/tr
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537062 548545
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/truncate
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537081 548564
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tsort
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537112 548595
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tty
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537097 548580
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/unexpand
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537061 548544
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/uniq
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537070 548553
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/unlink
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537080 548563
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/users
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537127 548610
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/wc
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537099 548582
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/who
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537071 548554
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/whoami
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537085 548568
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/yes
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537064 548547
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
-------------------------------------------------------------------------------
Rule Name: System boot changes (/var/log)
Severity Level: 100
-------------------------------------------------------------------------------
----------------------------------------
Added Objects: 2
----------------------------------------
Added object name: /var/log/unattended-upgrades/unattended-upgrades-dpkg_2012-11-28_06:52:20.987578.log
Added object name: /var/log/kern.log.4.gz
-------------------------------------------------------------------------------
Rule Name: Other configuration files (/etc)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 8
----------------------------------------
Modified object name: /etc
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 16:27:26 2012 Wed Nov 28 06:53:10 2012
Modified object name: /etc/apparmor.d
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 18:19:29 2012 Tue Nov 27 23:44:25 2012
Modified object name: /etc/apparmor.d/usr.local.bin.redis-server
Property: Expected Observed
------------- ----------- -----------
* Inode Number 276226 274423
* Size 266 322
* Modify Time Tue Nov 27 17:52:30 2012 Tue Nov 27 20:41:47 2012
* CRC32 Ce3NR8 A6wWs8
* MD5 AhAFAXOzmaQFH4ZDSyDBHT DbrvmuufcHfvisGzPc74vz
Modified object name: /etc/apt
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:42:32 2012 Wed Nov 28 06:52:59 2012
Modified object name: /etc/apt/apt.conf.d
Property: Expected Observed
------------- ----------- -----------
* Modify Time Thu Nov 8 06:48:20 2012 Wed Nov 28 06:52:58 2012
Modified object name: /etc/cron.daily
Property: Expected Observed
------------- ----------- -----------
* Modify Time Thu Nov 15 06:31:40 2012 Wed Nov 28 06:52:58 2012
Modified object name: /etc/ld.so.cache
Property: Expected Observed
------------- ----------- -----------
* Size 21921 22410
* Modify Time Tue Nov 27 16:27:26 2012 Wed Nov 28 06:53:10 2012
* CRC32 CNWCY8 D/e2rY
* MD5 ClRaIMuorTW4t/iD46D5mt CIPjIaM9dP9mNdmXmi/b9d
Modified object name: /etc/logrotate.d
Property: Expected Observed
------------- ----------- -----------
* Modify Time Thu Nov 15 06:31:39 2012 Wed Nov 28 06:52:59 2012
-------------------------------------------------------------------------------
Rule Name: Root file-system executables (/bin)
Severity Level: 100
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 29
----------------------------------------
Modified object name: /bin
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 06:47:01 2012 Wed Nov 28 06:52:33 2012
Modified object name: /bin/cat
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138373 146762
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/chgrp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138360 146749
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/chmod
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138357 146746
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/chown
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138358 146747
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/cp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138366 146755
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
* CRC32 Bu6s8I B4mwhn
* MD5 DE5eAbouaQ8uEyAwMpZ5DZ DmU0Th2y/SUmAkLgfE+iDi
Modified object name: /bin/date
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138369 146758
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/dd
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138362 146751
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/df
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138355 146744
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/dir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138354 146743
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/echo
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138363 146752
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/false
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138350 146739
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/ln
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138367 146756
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/ls
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138365 146754
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mkdir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138370 146759
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mknod
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138359 146748
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mktemp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138349 146738
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mv
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138361 146750
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
* CRC32 CGYJkk CDxCrf
* MD5 CUUdarXDqX8pskb8LvpTyD BT10HV9Tk8LopoqHl1ITXt
Modified object name: /bin/pwd
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138352 146741
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/readlink
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138353 146742
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/rm
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138364 146753
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/rmdir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138346 146735
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/sleep
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138348 146737
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/stty
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138371 146760
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/sync
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138351 146740
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/touch
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138368 146757
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/true
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138347 146736
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/uname
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138372 146761
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/vdir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138356 146745
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
================================================== =============================
Error Report:
================================================== =============================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
less rkhunter.log|grep -A 5 Warning
[13:44:19] Info: Emailing warnings to 'xxx@xx.com' using command '/usr/bin/mail -s "[rkhunter] Warnings found for ${HOST_NAME}"'
[13:44:19] Info: X will be automatically detected
[13:44:19] Info: Found the 'basename' command: /usr/bin/basename
[13:44:19] Info: Found the 'diff' command: /usr/bin/diff
[13:44:19] Info: Found the 'dirname' command: /usr/bin/dirname
[13:44:19] Info: Found the 'file' command: /usr/bin/file
--
[13:45:04] /usr/sbin/chroot [ Warning ]
[13:45:04] Warning: The file properties have changed:
[13:45:04] File: /usr/sbin/chroot
[13:45:04] Current inode: 548611 Stored inode: 537128
[13:45:04] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:04] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:05] /usr/sbin/cron [ OK ]
--
[13:45:20] /usr/bin/basename [ Warning ]
[13:45:20] Warning: The file properties have changed:
[13:45:20] File: /usr/bin/basename
[13:45:20] Current inode: 548541 Stored inode: 537058
[13:45:20] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:20] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:21] /usr/bin/chattr [ OK ]
--
[13:45:23] /usr/bin/cut [ Warning ]
[13:45:23] Warning: The file properties have changed:
[13:45:23] File: /usr/bin/cut
[13:45:23] Current inode: 548542 Stored inode: 537059
[13:45:23] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:23] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:24] /usr/bin/diff [ OK ]
[13:45:24] /usr/bin/dirname [ Warning ]
[13:45:24] Warning: The file properties have changed:
[13:45:24] File: /usr/bin/dirname
[13:45:25] Current inode: 548596 Stored inode: 537113
[13:45:25] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:25] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:25] /usr/bin/dpkg [ OK ]
--
[13:45:26] /usr/bin/du [ Warning ]
[13:45:27] Warning: The file properties have changed:
[13:45:27] File: /usr/bin/du
[13:45:27] Current inode: 548606 Stored inode: 537123
[13:45:27] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:27] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:28] /usr/bin/env [ Warning ]
[13:45:28] Warning: The file properties have changed:
[13:45:28] File: /usr/bin/env
[13:45:28] Current inode: 548567 Stored inode: 537084
[13:45:28] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:28] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:29] /usr/bin/file [ OK ]
--
[13:45:31] /usr/bin/groups [ Warning ]
[13:45:31] Warning: The file properties have changed:
[13:45:31] File: /usr/bin/groups
[13:45:32] Current inode: 548608 Stored inode: 537125
[13:45:32] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:32] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:32] Info: Found file '/usr/bin/groups': it is whitelisted for the 'script replacement' check.
[13:45:32] /usr/bin/head [ Warning ]
[13:45:33] Warning: The file properties have changed:
[13:45:33] File: /usr/bin/head
[13:45:33] Current inode: 548565 Stored inode: 537082
[13:45:33] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:33] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:34] /usr/bin/id [ Warning ]
[13:45:34] Warning: The file properties have changed:
[13:45:34] File: /usr/bin/id
[13:45:34] Current inode: 548585 Stored inode: 537102
[13:45:34] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:34] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:35] /usr/bin/killall [ OK ]
--
[13:45:41] /usr/bin/md5sum [ Warning ]
[13:45:41] Warning: The file properties have changed:
[13:45:41] File: /usr/bin/md5sum
[13:45:42] Current inode: 548571 Stored inode: 537088
[13:45:42] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:42] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:42] /usr/bin/mlocate [ OK ]
--
[13:45:48] /usr/bin/runcon [ Warning ]
[13:45:48] Warning: The file properties have changed:
[13:45:48] File: /usr/bin/runcon
[13:45:48] Current inode: 548558 Stored inode: 537075
[13:45:48] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:48] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:49] /usr/bin/sha1sum [ Warning ]
[13:45:49] Warning: The file properties have changed:
[13:45:49] File: /usr/bin/sha1sum
[13:45:49] Current inode: 548603 Stored inode: 537120
[13:45:50] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:50] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:50] /usr/bin/sha224sum [ Warning ]
[13:45:50] Warning: The file properties have changed:
[13:45:50] File: /usr/bin/sha224sum
[13:45:50] Current inode: 548566 Stored inode: 537083
[13:45:51] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:51] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:51] /usr/bin/sha256sum [ Warning ]
[13:45:51] Warning: The file properties have changed:
[13:45:51] File: /usr/bin/sha256sum
[13:45:51] Current inode: 548540 Stored inode: 530781
[13:45:52] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:52] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:52] /usr/bin/sha384sum [ Warning ]
[13:45:52] Warning: The file properties have changed:
[13:45:52] File: /usr/bin/sha384sum
[13:45:53] Current inode: 548546 Stored inode: 537063
[13:45:53] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:53] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:53] /usr/bin/sha512sum [ Warning ]
[13:45:54] Warning: The file properties have changed:
[13:45:54] File: /usr/bin/sha512sum
[13:45:54] Current inode: 548601 Stored inode: 537118
[13:45:54] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:54] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:55] /usr/bin/size [ OK ]
[13:45:56] /usr/bin/sort [ Warning ]
[13:45:56] Warning: The file properties have changed:
[13:45:56] File: /usr/bin/sort
[13:45:56] Current inode: 548578 Stored inode: 537095
[13:45:56] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:56] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:57] /usr/bin/stat [ Warning ]
[13:45:57] Warning: The file properties have changed:
[13:45:57] File: /usr/bin/stat
[13:45:57] Current inode: 548586 Stored inode: 537103
[13:45:57] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:57] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:58] /usr/bin/strace [ OK ]
--
[13:46:00] /usr/bin/tail [ Warning ]
[13:46:00] Warning: The file properties have changed:
[13:46:00] File: /usr/bin/tail
[13:46:00] Current inode: 548574 Stored inode: 537091
[13:46:00] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:00] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:01] /usr/bin/test [ Warning ]
[13:46:01] Warning: The file properties have changed:
[13:46:01] File: /usr/bin/test
[13:46:01] Current inode: 548600 Stored inode: 537117
[13:46:02] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:02] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:02] /usr/bin/top [ OK ]
[13:46:03] /usr/bin/touch [ Warning ]
[13:46:03] Warning: The file properties have changed:
[13:46:03] File: /usr/bin/touch
[13:46:03] Current inode: 548724 Stored inode: 537241
[13:46:03] Current file modification time: 1353363929 (19-nov-2012 23:25:29)
[13:46:03] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:04] /usr/bin/tr [ Warning ]
[13:46:04] Warning: The file properties have changed:
[13:46:04] File: /usr/bin/tr
[13:46:04] Current inode: 548545 Stored inode: 537062
[13:46:04] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:04] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:05] /usr/bin/uniq [ Warning ]
[13:46:05] Warning: The file properties have changed:
[13:46:05] File: /usr/bin/uniq
[13:46:05] Current inode: 548553 Stored inode: 537070
[13:46:05] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:05] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:06] /usr/bin/users [ Warning ]
[13:46:06] Warning: The file properties have changed:
[13:46:06] File: /usr/bin/users
[13:46:06] Current inode: 548610 Stored inode: 537127
[13:46:07] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:07] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:07] /usr/bin/vmstat [ OK ]
--
[13:46:09] /usr/bin/wc [ Warning ]
[13:46:09] Warning: The file properties have changed:
[13:46:09] File: /usr/bin/wc
[13:46:09] Current inode: 548582 Stored inode: 537099
[13:46:09] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:09] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:10] /usr/bin/wget [ OK ]
--
[13:46:12] /usr/bin/who [ Warning ]
[13:46:12] Warning: The file properties have changed:
[13:46:12] File: /usr/bin/who
[13:46:12] Current inode: 548554 Stored inode: 537071
[13:46:13] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:13] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:13] /usr/bin/whoami [ Warning ]
[13:46:13] Warning: The file properties have changed:
[13:46:13] File: /usr/bin/whoami
[13:46:13] Current inode: 548568 Stored inode: 537085
[13:46:14] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:14] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:14] /usr/bin/mawk [ OK ]
--
[13:46:32] /bin/cat [ Warning ]
[13:46:32] Warning: The file properties have changed:
[13:46:33] File: /bin/cat
[13:46:33] Current inode: 146762 Stored inode: 138373
[13:46:33] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:33] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:33] /bin/chmod [ Warning ]
[13:46:33] Warning: The file properties have changed:
[13:46:34] File: /bin/chmod
[13:46:34] Current inode: 146746 Stored inode: 138357
[13:46:34] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:34] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:34] /bin/chown [ Warning ]
[13:46:34] Warning: The file properties have changed:
[13:46:34] File: /bin/chown
[13:46:35] Current inode: 146747 Stored inode: 138358
[13:46:35] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:35] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:35] /bin/cp [ Warning ]
[13:46:35] Warning: The file properties have changed:
[13:46:35] File: /bin/cp
[13:46:35] Current hash: 38b30c83d39c4c192fd4f59a6fec5fabf1a043b7
[13:46:36] Stored hash : 159f0d346148b8d2146d56ff445d4b44ab852bef
[13:46:36] Current inode: 146755 Stored inode: 138366
[13:46:36] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
--
[13:46:36] /bin/date [ Warning ]
[13:46:36] Warning: The file properties have changed:
[13:46:36] File: /bin/date
[13:46:37] Current inode: 146758 Stored inode: 138369
[13:46:37] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:37] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:37] /bin/df [ Warning ]
[13:46:37] Warning: The file properties have changed:
[13:46:37] File: /bin/df
[13:46:37] Current inode: 146744 Stored inode: 138355
[13:46:38] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:38] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:38] /bin/dmesg [ OK ]
[13:46:39] /bin/echo [ Warning ]
[13:46:39] Warning: The file properties have changed:
[13:46:39] File: /bin/echo
[13:46:39] Current inode: 146752 Stored inode: 138363
[13:46:39] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:39] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:40] /bin/ed [ OK ]
--
[13:46:48] /bin/ls [ Warning ]
[13:46:48] Warning: The file properties have changed:
[13:46:49] File: /bin/ls
[13:46:49] Current inode: 146754 Stored inode: 138365
[13:46:49] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:49] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:49] /bin/lsmod [ OK ]
[13:46:50] /bin/mktemp [ Warning ]
[13:46:50] Warning: The file properties have changed:
[13:46:50] File: /bin/mktemp
[13:46:50] Current inode: 146738 Stored inode: 138349
[13:46:50] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:51] Stored file modification time : 1349148321 (02-okt-2012 05:25:22)
[13:46:51] /bin/more [ OK ]
--
[13:46:52] /bin/mv [ Warning ]
[13:46:52] Warning: The file properties have changed:
[13:46:52] File: /bin/mv
[13:46:52] Current hash: 6c0c3d6b439466e6a4ff0894ddbfae9a8d4a93de
[13:46:52] Stored hash : 9d28a65fb8cfb59169dda335482ab117ac0085bc
[13:46:52] Current inode: 146750 Stored inode: 138361
[13:46:53] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
--
[13:46:54] /bin/pwd [ Warning ]
[13:46:54] Warning: The file properties have changed:
[13:46:54] File: /bin/pwd
[13:46:54] Current inode: 146741 Stored inode: 138352
[13:46:54] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:54] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:55] /bin/readlink [ Warning ]
[13:46:55] Warning: The file properties have changed:
[13:46:55] File: /bin/readlink
[13:46:55] Current inode: 146742 Stored inode: 138353
[13:46:55] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:55] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:56] /bin/sed [ OK ]
--
[13:46:58] /bin/touch [ Warning ]
[13:46:58] Warning: The file properties have changed:
[13:46:58] File: /bin/touch
[13:46:58] Current inode: 146757 Stored inode: 138368
[13:46:58] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:58] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:58] /bin/uname [ Warning ]
[13:46:59] Warning: The file properties have changed:
[13:46:59] File: /bin/uname
[13:46:59] Current inode: 146761 Stored inode: 138372
[13:46:59] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:59] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:47:00] /bin/which [ OK ]
Note:
During the setup, I had some changes in my tripwire/rkhunter reports but those were all explainable like "you added the binary nginx to path blabla" this is the first time I get REALLY strange reports.
Note number 2:
When I do md5sum (on my main computer AND laptop on /bin/ls) I get the same sum
1925024a82af85d47991e1f050523357 /bin/ls
and I have 12.04.1 LTS, can anyone confirm this?
Another strange thing is that the /bin folder seems to have a lot of binaries changed at the same date as my main desktop computer, so I suspect a false positive:
ls -ltr /bin
lrwxrwxrwx 1 root root 7 nov 16 19:00 static-sh -> busybox
-rwxr-xr-x 1 root root 1647864 nov 16 19:00 busybox
-rwxr-xr-x 1 root root 104512 nov 19 23:25 vdir
-rwxr-xr-x 1 root root 26180 nov 19 23:25 uname
-rwxr-xr-x 1 root root 22044 nov 19 23:25 true
-rwxr-xr-x 1 root root 54980 nov 19 23:25 touch
-rwxr-xr-x 1 root root 22052 nov 19 23:25 sync
-rwxr-xr-x 1 root root 58992 nov 19 23:25 stty
-rwxr-xr-x 1 root root 26156 nov 19 23:25 sleep
-rwxr-xr-x 1 root root 34376 nov 19 23:25 rmdir
-rwxr-xr-x 1 root root 54912 nov 19 23:25 rm
-rwxr-xr-x 1 root root 34404 nov 19 23:25 readlink
-rwxr-xr-x 1 root root 26220 nov 19 23:25 pwd
-rwxr-xr-x 1 root root 112488 nov 19 23:25 mv
-rwxr-xr-x 1 root root 34436 nov 19 23:25 mktemp
-rwxr-xr-x 1 root root 30272 nov 19 23:25 mknod
-rwxr-xr-x 1 root root 42624 nov 19 23:25 mkdir
-rwxr-xr-x 1 root root 104508 nov 19 23:25 ls
-rwxr-xr-x 1 root root 46720 nov 19 23:25 ln
-rwxr-xr-x 1 root root 22044 nov 19 23:25 false
-rwxr-xr-x 1 root root 26152 nov 19 23:25 echo
-rwxr-xr-x 1 root root 104508 nov 19 23:25 dir
-rwxr-xr-x 1 root root 79632 nov 19 23:25 df
-rwxr-xr-x 1 root root 54984 nov 19 23:25 dd
-rwxr-xr-x 1 root root 54916 nov 19 23:25 date
-rwxr-xr-x 1 root root 120708 nov 19 23:25 cp
-rwxr-xr-x 1 root root 54936 nov 19 23:25 chown
-rwxr-xr-x 1 root root 50804 nov 19 23:25 chmod
-rwxr-xr-x 1 root root 54928 nov 19 23:25 chgrp
-rwxr-xr-x 1 root root 46764 nov 19 23:25 cat
in order to test my hypothesis I even booted up an old laptop, did ls -ltr /bin and the apt-get upgrade and then ls -ltr /bin and then I noticed that my /bin/ files have changed with the same dates "nov 19" as on my other boxed... This confirms my hypothesis. I will post the logs here:
total 8664
-rwxr-xr-x 1 root root 4788 Mar 17 2008 fgetty-login2
-rwxr-xr-x 1 root root 2656 Mar 17 2008 fgetty-login
-rwxr-xr-x 1 root root 9604 Mar 17 2008 checkpassword
-rwxr-xr-x 1 root root 170016 Dec 3 2010 nano
-rwxr-xr-x 1 root root 59472 Apr 30 2011 sed
-rwxr-xr-x 4 root root 13852 May 26 2011 ypdomainname
-rwxr-xr-x 4 root root 13852 May 26 2011 nisdomainname
-rwxr-xr-x 1 root root 13848 May 26 2011 hostname
-rwxr-xr-x 4 root root 13852 May 26 2011 domainname
-rwxr-xr-x 4 root root 13852 May 26 2011 dnsdomainname
lrwxrwxrwx 1 root root 20 Jun 9 2011 mt -> /etc/alternatives/mt
lrwxrwxrwx 1 root root 20 Jun 9 2011 nc -> /etc/alternatives/nc
lrwxrwxrwx 1 root root 24 Jun 9 2011 netcat -> /etc/alternatives/netcat
lrwxrwxrwx 1 root root 4 Jun 9 2011 rnano -> nano
-rwxr-xr-x 1 root root 26152 Jul 1 2011 nc.openbsd
-rwxr-xr-x 1 root root 7506 Aug 10 2011 lesspipe
lrwxrwxrwx 1 root root 8 Aug 10 2011 lessfile -> lesspipe
-rwxr-xr-x 1 root root 14460 Aug 10 2011 lesskey
-rwxr-xr-x 1 root root 9640 Aug 10 2011 lessecho
-rwxr-xr-x 1 root root 141240 Aug 10 2011 less
-rwxr-xr-x 1 root root 42612 Oct 17 2011 ed
-rwsr-xr-x 1 root root 39116 Nov 8 2011 ping6
-rwsr-xr-x 1 root root 34740 Nov 8 2011 ping
-rwxr-xr-x 1 root root 5540 Nov 20 2011 lsmod
-rwxr-xr-x 1 root root 87900 Dec 12 2011 ps
-rwxr-xr-x 1 root root 17968 Dec 12 2011 kill
-rwxr-xr-x 1 root root 1297 Dec 15 2011 bzmore
-rwxr-xr-x 1 root root 3642 Dec 15 2011 bzgrep
-rwxr-xr-x 1 root root 4877 Dec 15 2011 bzexe
-rwxr-xr-x 1 root root 2140 Dec 15 2011 bzdiff
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzless -> bzmore
-rwxr-xr-x 1 root root 9596 Dec 15 2011 bzip2recover
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzip2
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzfgrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzegrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzcmp -> bzdiff
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzcat
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bunzip2
-rwxr-xr-x 1 root root 153692 Dec 16 2011 grep
-rwxr-xr-x 1 root root 108500 Dec 16 2011 fgrep
-rwxr-xr-x 1 root root 149596 Dec 16 2011 egrep
-rwxr-xr-x 1 root root 30788 Dec 18 2011 setfacl
-rwxr-xr-x 1 root root 22500 Dec 18 2011 getfacl
-rwxr-xr-x 1 root root 13800 Dec 18 2011 chacl
-rwxr-xr-x 1 root root 5015 Feb 9 2012 znew
-rwxr-xr-x 1 root root 2502 Feb 9 2012 zmore
-rwxr-xr-x 1 root root 1797 Feb 9 2012 zless
-rwxr-xr-x 1 root root 5986 Feb 9 2012 zgrep
-rwxr-xr-x 1 root root 2078 Feb 9 2012 zforce
-rwxr-xr-x 1 root root 121 Feb 9 2012 zfgrep
-rwxr-xr-x 1 root root 121 Feb 9 2012 zegrep
-rwxr-xr-x 1 root root 4534 Feb 9 2012 zdiff
-rwxr-xr-x 1 root root 1721 Feb 9 2012 zcmp
-rwxr-xr-x 1 root root 1939 Feb 9 2012 zcat
-rwxr-xr-x 2 root root 2251 Feb 9 2012 uncompress
-rwxr-xr-x 1 root root 5937 Feb 9 2012 gzexe
-rwxr-xr-x 2 root root 2251 Feb 9 2012 gunzip
-rwxr-xr-x 1 root root 86040 Feb 9 2012 gzip
-rwxr-xr-x 1 root root 22120 Feb 9 2012 whiptail
-rwxr-xr-x 1 root root 9732 Mar 2 2012 ulockmgr_server
-rwsr-xr-x 1 root root 26252 Mar 2 2012 fusermount
lrwxrwxrwx 1 root root 4 Mar 29 2012 sh -> dash
-rwxr-xr-x 1 root root 100284 Mar 29 2012 dash
-rwxr-xr-x 1 root root 946 Mar 29 2012 which
-rwxr-xr-x 1 root root 9580 Mar 29 2012 tempfile
-rwxr-xr-x 1 root root 14044 Mar 29 2012 run-parts
-rwsr-xr-x 1 root root 67720 Mar 30 2012 umount
-rwxr-xr-x 1 root root 13836 Mar 30 2012 tailf
-rwsr-xr-x 1 root root 88760 Mar 30 2012 mount
-rwxr-xr-x 1 root root 34492 Mar 30 2012 more
-rwxr-xr-x 1 root root 43312 Mar 30 2012 lsblk
-rwxr-xr-x 1 root root 34848 Mar 30 2012 findmnt
-rwxr-xr-x 1 root root 22020 Mar 30 2012 dmesg
-rwxr-xr-x 1 root root 305968 Mar 31 2012 tar
-rwxr-xr-x 1 root root 113920 Mar 31 2012 netstat
-rwxr-xr-x 1 root root 2762 Mar 31 2012 unicode_start
lrwxrwxrwx 1 root root 6 Mar 31 2012 open -> openvt
-rwxr-xr-x 1 root root 38612 Mar 31 2012 setfont
-rwxr-xr-x 1 root root 13844 Mar 31 2012 openvt
-rwxr-xr-x 1 root root 86856 Mar 31 2012 loadkeys
-rwxr-xr-x 1 root root 9652 Mar 31 2012 kbd_mode
-rwxr-xr-x 1 root root 9656 Mar 31 2012 fgconsole
-rwxr-xr-x 1 root root 57968 Mar 31 2012 dumpkeys
-rwxr-xr-x 1 root root 9648 Mar 31 2012 chvt
-rwxr-xr-x 1 root root 67624 Apr 1 2012 mt-gnu
-rwxr-xr-x 1 root root 138888 Apr 1 2012 cpio
lrwxrwxrwx 1 root root 4 Apr 3 2012 rbash -> bash
-rwxr-xr-x 1 root root 920788 Apr 3 2012 bash
-rwxr-xr-x 1 root root 71412 Apr 10 2012 ss
-rwxr-xr-x 1 root root 253984 Apr 10 2012 ip
-rwxr-xr-x 1 root root 30480 Apr 13 2012 plymouth-upstart-bridge
-rwxr-xr-x 1 root root 34420 Apr 13 2012 plymouth
lrwxrwxrwx 1 root root 7 Apr 13 2012 static-sh -> busybox
-rwxr-xr-x 1 root root 1639672 Apr 13 2012 busybox
-rwxr-xr-x 1 root root 12052 Apr 19 2012 setupcon
-rwxr-xr-x 1 root root 254 Apr 26 2012 running-in-container
-rwxr-xr-x 1 root root 16005 Apr 26 2012 initctl2dot
-rwxr-xr-x 1 root root 5935 Apr 26 2012 init-checkconf
-rwxr-xr-x 1 root root 5508 Jun 14 08:13 vmmouse_detect
-rwxr-xr-x 1 root root 1011 Jul 5 18:59 cgroups-mount
-rwxr-xr-x 1 root root 599 Jul 5 19:09 cgroups-umount
-rwxr-xr-x 1 root root 30832 Jul 17 01:59 fuser
lrwxrwxrwx 1 root root 14 Jul 26 20:23 pidof -> /sbin/killall5
-rwxr-xr-x 1 root root 5544 Jul 26 20:23 mountpoint
-rwxr-xr-x 1 root root 42656 Sep 11 06:12 ntfswipe
-rwxr-xr-x 1 root root 34176 Sep 11 06:12 ntfstruncate
-rwxr-xr-x 1 root root 30124 Sep 11 06:12 ntfsmove
-rwxr-xr-x 1 root root 25992 Sep 11 06:12 ntfsmftalloc
-rwxr-xr-x 1 root root 31204 Sep 11 06:12 ntfsls
-rwxr-xr-x 1 root root 58812 Sep 11 06:12 ntfsinfo
-rwxr-xr-x 1 root root 42420 Sep 11 06:12 ntfsfix
-rwxr-xr-x 1 root root 21856 Sep 11 06:12 ntfsdump_logfile
-rwxr-xr-x 1 root root 42484 Sep 11 06:12 ntfsdecrypt
-rwxr-xr-x 1 root root 34220 Sep 11 06:12 ntfscmp
-rwxr-xr-x 1 root root 34220 Sep 11 06:12 ntfscluster
-rwxr-xr-x 1 root root 30072 Sep 11 06:12 ntfsck
-rwxr-xr-x 1 root root 26028 Sep 11 06:12 ntfscat
-rwxr-xr-x 1 root root 17760 Sep 11 06:12 ntfs-3g.usermap
-rwxr-xr-x 1 root root 66940 Sep 11 06:12 ntfs-3g.secaudit
-rwxr-xr-x 1 root root 9620 Sep 11 06:12 ntfs-3g.probe
-rwxr-xr-x 1 root root 58992 Sep 11 06:12 ntfs-3g
-rwxr-xr-x 1 root root 63068 Sep 11 06:12 lowntfs-3g
-rwsr-xr-x 1 root root 31116 Sep 13 00:29 su
-rwxr-xr-x 1 root root 43312 Sep 13 00:29 login
-rwxr-xr-x 1 root root 104512 Oct 2 05:25 vdir
-rwxr-xr-x 1 root root 26180 Oct 2 05:25 uname
-rwxr-xr-x 1 root root 22044 Oct 2 05:25 true
-rwxr-xr-x 1 root root 54980 Oct 2 05:25 touch
-rwxr-xr-x 1 root root 22052 Oct 2 05:25 sync
-rwxr-xr-x 1 root root 58992 Oct 2 05:25 stty
-rwxr-xr-x 1 root root 26156 Oct 2 05:25 sleep
-rwxr-xr-x 1 root root 34376 Oct 2 05:25 rmdir
-rwxr-xr-x 1 root root 54912 Oct 2 05:25 rm
-rwxr-xr-x 1 root root 34404 Oct 2 05:25 readlink
-rwxr-xr-x 1 root root 26220 Oct 2 05:25 pwd
-rwxr-xr-x 1 root root 112488 Oct 2 05:25 mv
-rwxr-xr-x 1 root root 34436 Oct 2 05:25 mktemp
-rwxr-xr-x 1 root root 30272 Oct 2 05:25 mknod
-rwxr-xr-x 1 root root 42624 Oct 2 05:25 mkdir
-rwxr-xr-x 1 root root 104508 Oct 2 05:25 ls
-rwxr-xr-x 1 root root 46720 Oct 2 05:25 ln
-rwxr-xr-x 1 root root 22044 Oct 2 05:25 false
-rwxr-xr-x 1 root root 26152 Oct 2 05:25 echo
-rwxr-xr-x 1 root root 104508 Oct 2 05:25 dir
-rwxr-xr-x 1 root root 79632 Oct 2 05:25 df
-rwxr-xr-x 1 root root 54984 Oct 2 05:25 dd
-rwxr-xr-x 1 root root 54916 Oct 2 05:25 date
-rwxr-xr-x 1 root root 120708 Oct 2 05:25 cp
-rwxr-xr-x 1 root root 54936 Oct 2 05:25 chown
-rwxr-xr-x 1 root root 50804 Oct 2 05:25 chmod
-rwxr-xr-x 1 root root 54928 Oct 2 05:25 chgrp
-rwxr-xr-x 1 root root 46764 Oct 2 05:25 cat
-rwxr-xr-x 1 root root 9536 Oct 3 19:03 dbus-uuidgen
-rwxr-xr-x 1 root root 439704 Oct 3 19:03 dbus-daemon
-rwxr-xr-x 1 root root 9544 Oct 3 19:03 dbus-cleanup-sockets
anon@eee:~$ sudo apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
apt apt-transport-https apt-utils bamfdaemon busybox-initramfs busybox-static coreutils gir1.2-gtk-3.0
gnome-accessibility-themes gnome-themes-standard im-switch indicator-messages indicator-status-provider-mc5
indicator-status-provider-pidgin libapt-inst1.4 libapt-pkg4.12 libbamf0 libbamf3-0 libgail-3-0 libgtk-3-0 libgtk-3-bin
libgtk-3-common libindicator-messages-status-provider1 light-themes lxc make python-ubuntu-sso-client seahorse skype
skype-bin ubuntu-sso-client ubuntu-sso-client-gtk ubuntu-sso-client-qt
33 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/42.5 MB of archives.
After this operation, 683 kB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Extracting templates from packages: 100%
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace coreutils 8.13-3ubuntu3.1 (using .../coreutils_8.13-3ubuntu3.2_i386.deb) ...
Unpacking replacement coreutils ...
Processing triggers for man-db ...
Processing triggers for install-info ...
Setting up coreutils (8.13-3ubuntu3.2) ...
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace libapt-pkg4.12 0.8.16~exp12ubuntu10.5 (using .../libapt-pkg4.12_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement libapt-pkg4.12 ...
Setting up libapt-pkg4.12 (0.8.16~exp12ubuntu10.6) ...
Processing triggers for libc-bin ...
ldconfig deferred processing now taking place
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace apt 0.8.16~exp12ubuntu10.5 (using .../apt_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement apt ...
Processing triggers for man-db ...
Setting up apt (0.8.16~exp12ubuntu10.6) ...
gpg: key 437D05B5: "Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>" not changed
gpg: key FBB75451: "Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>" not changed
gpg: key C0B21F32: "Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>" not changed
gpg: key EFE21092: "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" not changed
gpg: Total number processed: 4
gpg: unchanged: 4
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace libapt-inst1.4 0.8.16~exp12ubuntu10.5 (using .../libapt-inst1.4_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement libapt-inst1.4 ...
Preparing to replace libbamf3-0 0.2.118-0ubuntu0.2 (using .../libbamf3-0_0.2.118-0ubuntu0.3_i386.deb) ...
Unpacking replacement libbamf3-0 ...
Preparing to replace libgail-3-0 3.4.2-0ubuntu0.4 (using .../libgail-3-0_3.4.2-0ubuntu0.5_i386.deb) ...
Unpacking replacement libgail-3-0 ...
Preparing to replace libgtk-3-bin 3.4.2-0ubuntu0.4 (using .../libgtk-3-bin_3.4.2-0ubuntu0.5_i386.deb) ...
Leaving 'diversion of /usr/sbin/update-icon-caches to /usr/sbin/update-icon-caches.gtk2 by libgtk-3-bin'
Leaving 'diversion of /usr/share/man/man8/update-icon-caches.8.gz to /usr/share/man/man8/update-icon-caches.gtk2.8.gz by libgtk-3-bin'
Unpacking replacement libgtk-3-bin ...
Preparing to replace libgtk-3-0 3.4.2-0ubuntu0.4 (using .../libgtk-3-0_3.4.2-0ubuntu0.5_i386.deb) ...
Unpacking replacement libgtk-3-0 ...
Preparing to replace libgtk-3-common 3.4.2-0ubuntu0.4 (using .../libgtk-3-common_3.4.2-0ubuntu0.5_all.deb) ...
Unpacking replacement libgtk-3-common ...
Preparing to replace libbamf0 0.2.118-0ubuntu0.2 (using .../libbamf0_0.2.118-0ubuntu0.3_i386.deb) ...
Unpacking replacement libbamf0 ...
Preparing to replace bamfdaemon 0.2.118-0ubuntu0.2 (using .../bamfdaemon_0.2.118-0ubuntu0.3_i386.deb) ...
Unpacking replacement bamfdaemon ...
Preparing to replace ubuntu-sso-client-qt 3.0.2-0ubuntu2 (using .../ubuntu-sso-client-qt_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement ubuntu-sso-client-qt ...
Preparing to replace gir1.2-gtk-3.0 3.4.2-0ubuntu0.4 (using .../gir1.2-gtk-3.0_3.4.2-0ubuntu0.5_i386.deb) ...
Unpacking replacement gir1.2-gtk-3.0 ...
Preparing to replace ubuntu-sso-client-gtk 3.0.2-0ubuntu2 (using .../ubuntu-sso-client-gtk_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement ubuntu-sso-client-gtk ...
Preparing to replace ubuntu-sso-client 3.0.2-0ubuntu2 (using .../ubuntu-sso-client_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement ubuntu-sso-client ...
Preparing to replace python-ubuntu-sso-client 3.0.2-0ubuntu2 (using .../python-ubuntu-sso-client_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement python-ubuntu-sso-client ...
Preparing to replace apt-utils 0.8.16~exp12ubuntu10.5 (using .../apt-utils_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement apt-utils ...
Preparing to replace busybox-initramfs 1:1.18.5-1ubuntu4 (using .../busybox-initramfs_1%3a1.18.5-1ubuntu4.1_i386.deb) ...
Unpacking replacement busybox-initramfs ...
Preparing to replace apt-transport-https 0.8.16~exp12ubuntu10.5 (using .../apt-transport-https_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement apt-transport-https ...
Preparing to replace busybox-static 1:1.18.5-1ubuntu4 (using .../busybox-static_1%3a1.18.5-1ubuntu4.1_i386.deb) ...
Unpacking replacement busybox-static ...
Preparing to replace gnome-accessibility-themes 3.4.1-0ubuntu1.1 (using .../gnome-accessibility-themes_3.4.1-0ubuntu1.2_all.deb) ...
Unpacking replacement gnome-accessibility-themes ...
Preparing to replace gnome-themes-standard 3.4.1-0ubuntu1.1 (using .../gnome-themes-standard_3.4.1-0ubuntu1.2_i386.deb) ...
Unpacking replacement gnome-themes-standard ...
Preparing to replace im-switch 1.20ubuntu5 (using .../im-switch_1.20ubuntu5.1_all.deb) ...
update-alternatives: using /etc/X11/xinit/xinput.d/default-xim to provide /etc/X11/xinit/xinput.d/all_ALL (xinput-all_ALL) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/none to provide /etc/X11/xinit/xinput.d/all_ALL (xinput-all_ALL) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/th-gtk to provide /etc/X11/xinit/xinput.d/th_TH (xinput-th_TH) in auto mode.
Unpacking replacement im-switch ...
Preparing to replace libindicator-messages-status-provider1 0.6.0-0ubuntu1 (using .../libindicator-messages-status-provider1_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement libindicator-messages-status-provider1 ...
Preparing to replace indicator-messages 0.6.0-0ubuntu1 (using .../indicator-messages_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement indicator-messages ...
Preparing to replace indicator-status-provider-mc5 0.6.0-0ubuntu1 (using .../indicator-status-provider-mc5_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement indicator-status-provider-mc5 ...
Preparing to replace indicator-status-provider-pidgin 0.6.0-0ubuntu1 (using .../indicator-status-provider-pidgin_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement indicator-status-provider-pidgin ...
Preparing to replace light-themes 0.1.9.1-0ubuntu1.1 (using .../light-themes_0.1.9.1-0ubuntu1.2_all.deb) ...
Unpacking replacement light-themes ...
Preparing to replace lxc 0.7.5-3ubuntu63 (using .../lxc_0.7.5-3ubuntu65_i386.deb) ...
Unpacking replacement lxc ...
Preparing to replace make 3.81-8.1ubuntu1 (using .../make_3.81-8.1ubuntu1.1_i386.deb) ...
Unpacking replacement make ...
Preparing to replace seahorse 3.2.2-0ubuntu2 (using .../seahorse_3.2.2-0ubuntu2.1_i386.deb) ...
Unpacking replacement seahorse ...
Preparing to replace skype 4.0.0.8-0oneiric1 (using .../skype_4.1.0.20.0-0ubuntu0.12.04.1_i386.deb) ...
Unpacking replacement skype ...
Preparing to replace skype-bin 4.0.0.8-0oneiric1 (using .../skype-bin_4.1.0.20.0-0ubuntu0.12.04.1_i386.deb) ...
Unpacking replacement skype-bin ...
Processing triggers for man-db ...
Processing triggers for libglib2.0-0 ...
Processing triggers for gconf2 ...
Processing triggers for desktop-file-utils ...
Processing triggers for gnome-menus ...
Processing triggers for menu ...
Processing triggers for ureadahead ...
ureadahead will be reprofiled on next reboot
Processing triggers for hicolor-icon-theme ...
Setting up libapt-inst1.4 (0.8.16~exp12ubuntu10.6) ...
Setting up libgtk-3-common (3.4.2-0ubuntu0.5) ...
Setting up libgtk-3-0 (3.4.2-0ubuntu0.5) ...
Setting up bamfdaemon (0.2.118-0ubuntu0.3) ...
Rebuilding /usr/share/applications/bamf.index...
Setting up libbamf3-0 (0.2.118-0ubuntu0.3) ...
Setting up libgail-3-0 (3.4.2-0ubuntu0.5) ...
Setting up libgtk-3-bin (3.4.2-0ubuntu0.5) ...
Setting up libbamf0 (0.2.118-0ubuntu0.3) ...
Setting up gir1.2-gtk-3.0 (3.4.2-0ubuntu0.5) ...
Setting up python-ubuntu-sso-client (3.0.2-0ubuntu3) ...
Setting up ubuntu-sso-client (3.0.2-0ubuntu3) ...
Setting up ubuntu-sso-client-qt (3.0.2-0ubuntu3) ...
Setting up ubuntu-sso-client-gtk (3.0.2-0ubuntu3) ...
Setting up apt-utils (0.8.16~exp12ubuntu10.6) ...
Setting up busybox-initramfs (1:1.18.5-1ubuntu4.1) ...
Setting up apt-transport-https (0.8.16~exp12ubuntu10.6) ...
Setting up busybox-static (1:1.18.5-1ubuntu4.1) ...
Setting up gnome-accessibility-themes (3.4.1-0ubuntu1.2) ...
Setting up gnome-themes-standard (3.4.1-0ubuntu1.2) ...
Setting up im-switch (1.20ubuntu5.1) ...
Installing new version of config file /etc/X11/Xsession.d/80im-switch ...
update-alternatives: using /etc/X11/xinit/xinput.d/default to provide /etc/X11/xinit/xinput.d/all_ALL (xinput-all_ALL) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/lo-gtk to provide /etc/X11/xinit/xinput.d/lo_TH (xinput-lo_TH) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/th-xim to provide /etc/X11/xinit/xinput.d/th_TH (xinput-th_TH) in auto mode.
Setting up libindicator-messages-status-provider1 (0.6.0-0ubuntu2) ...
Setting up indicator-messages (0.6.0-0ubuntu2) ...
Setting up indicator-status-provider-mc5 (0.6.0-0ubuntu2) ...
Setting up indicator-status-provider-pidgin (0.6.0-0ubuntu2) ...
Setting up light-themes (0.1.9.1-0ubuntu1.2) ...
Setting up lxc (0.7.5-3ubuntu65) ...
Installing new version of config file /etc/init/lxc-net.conf ...
* Restarting DNS forwarder and DHCP server dnsmasq [ OK ]
Setting up make (3.81-8.1ubuntu1.1) ...
Setting up seahorse (3.2.2-0ubuntu2.1) ...
Setting up skype-bin (4.1.0.20.0-0ubuntu0.12.04.1) ...
Setting up skype (4.1.0.20.0-0ubuntu0.12.04.1) ...
Processing triggers for libc-bin ...
ldconfig deferred processing now taking place
Processing triggers for menu ...
anon@eee:~$ ls -ltr /bin
total 8672
-rwxr-xr-x 1 root root 4788 Mar 17 2008 fgetty-login2
-rwxr-xr-x 1 root root 2656 Mar 17 2008 fgetty-login
-rwxr-xr-x 1 root root 9604 Mar 17 2008 checkpassword
-rwxr-xr-x 1 root root 170016 Dec 3 2010 nano
-rwxr-xr-x 1 root root 59472 Apr 30 2011 sed
-rwxr-xr-x 4 root root 13852 May 26 2011 ypdomainname
-rwxr-xr-x 4 root root 13852 May 26 2011 nisdomainname
-rwxr-xr-x 1 root root 13848 May 26 2011 hostname
-rwxr-xr-x 4 root root 13852 May 26 2011 domainname
-rwxr-xr-x 4 root root 13852 May 26 2011 dnsdomainname
lrwxrwxrwx 1 root root 20 Jun 9 2011 mt -> /etc/alternatives/mt
lrwxrwxrwx 1 root root 20 Jun 9 2011 nc -> /etc/alternatives/nc
lrwxrwxrwx 1 root root 24 Jun 9 2011 netcat -> /etc/alternatives/netcat
lrwxrwxrwx 1 root root 4 Jun 9 2011 rnano -> nano
-rwxr-xr-x 1 root root 26152 Jul 1 2011 nc.openbsd
-rwxr-xr-x 1 root root 7506 Aug 10 2011 lesspipe
lrwxrwxrwx 1 root root 8 Aug 10 2011 lessfile -> lesspipe
-rwxr-xr-x 1 root root 14460 Aug 10 2011 lesskey
-rwxr-xr-x 1 root root 9640 Aug 10 2011 lessecho
-rwxr-xr-x 1 root root 141240 Aug 10 2011 less
-rwxr-xr-x 1 root root 42612 Oct 17 2011 ed
-rwsr-xr-x 1 root root 39116 Nov 8 2011 ping6
-rwsr-xr-x 1 root root 34740 Nov 8 2011 ping
-rwxr-xr-x 1 root root 5540 Nov 20 2011 lsmod
-rwxr-xr-x 1 root root 87900 Dec 12 2011 ps
-rwxr-xr-x 1 root root 17968 Dec 12 2011 kill
-rwxr-xr-x 1 root root 1297 Dec 15 2011 bzmore
-rwxr-xr-x 1 root root 3642 Dec 15 2011 bzgrep
-rwxr-xr-x 1 root root 4877 Dec 15 2011 bzexe
-rwxr-xr-x 1 root root 2140 Dec 15 2011 bzdiff
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzless -> bzmore
-rwxr-xr-x 1 root root 9596 Dec 15 2011 bzip2recover
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzip2
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzfgrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzegrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzcmp -> bzdiff
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzcat
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bunzip2
-rwxr-xr-x 1 root root 153692 Dec 16 2011 grep
-rwxr-xr-x 1 root root 108500 Dec 16 2011 fgrep
-rwxr-xr-x 1 root root 149596 Dec 16 2011 egrep
-rwxr-xr-x 1 root root 30788 Dec 18 2011 setfacl
-rwxr-xr-x 1 root root 22500 Dec 18 2011 getfacl
-rwxr-xr-x 1 root root 13800 Dec 18 2011 chacl
-rwxr-xr-x 1 root root 5015 Feb 9 2012 znew
-rwxr-xr-x 1 root root 2502 Feb 9 2012 zmore
-rwxr-xr-x 1 root root 1797 Feb 9 2012 zless
-rwxr-xr-x 1 root root 5986 Feb 9 2012 zgrep
-rwxr-xr-x 1 root root 2078 Feb 9 2012 zforce
-rwxr-xr-x 1 root root 121 Feb 9 2012 zfgrep
-rwxr-xr-x 1 root root 121 Feb 9 2012 zegrep
-rwxr-xr-x 1 root root 4534 Feb 9 2012 zdiff
-rwxr-xr-x 1 root root 1721 Feb 9 2012 zcmp
-rwxr-xr-x 1 root root 1939 Feb 9 2012 zcat
-rwxr-xr-x 2 root root 2251 Feb 9 2012 uncompress
-rwxr-xr-x 1 root root 5937 Feb 9 2012 gzexe
-rwxr-xr-x 2 root root 2251 Feb 9 2012 gunzip
-rwxr-xr-x 1 root root 86040 Feb 9 2012 gzip
-rwxr-xr-x 1 root root 22120 Feb 9 2012 whiptail
-rwxr-xr-x 1 root root 9732 Mar 2 2012 ulockmgr_server
-rwsr-xr-x 1 root root 26252 Mar 2 2012 fusermount
lrwxrwxrwx 1 root root 4 Mar 29 2012 sh -> dash
-rwxr-xr-x 1 root root 100284 Mar 29 2012 dash
-rwxr-xr-x 1 root root 946 Mar 29 2012 which
-rwxr-xr-x 1 root root 9580 Mar 29 2012 tempfile
-rwxr-xr-x 1 root root 14044 Mar 29 2012 run-parts
-rwsr-xr-x 1 root root 67720 Mar 30 2012 umount
-rwxr-xr-x 1 root root 13836 Mar 30 2012 tailf
-rwsr-xr-x 1 root root 88760 Mar 30 2012 mount
-rwxr-xr-x 1 root root 34492 Mar 30 2012 more
-rwxr-xr-x 1 root root 43312 Mar 30 2012 lsblk
-rwxr-xr-x 1 root root 34848 Mar 30 2012 findmnt
-rwxr-xr-x 1 root root 22020 Mar 30 2012 dmesg
-rwxr-xr-x 1 root root 305968 Mar 31 2012 tar
-rwxr-xr-x 1 root root 113920 Mar 31 2012 netstat
-rwxr-xr-x 1 root root 2762 Mar 31 2012 unicode_start
lrwxrwxrwx 1 root root 6 Mar 31 2012 open -> openvt
-rwxr-xr-x 1 root root 38612 Mar 31 2012 setfont
-rwxr-xr-x 1 root root 13844 Mar 31 2012 openvt
-rwxr-xr-x 1 root root 86856 Mar 31 2012 loadkeys
-rwxr-xr-x 1 root root 9652 Mar 31 2012 kbd_mode
-rwxr-xr-x 1 root root 9656 Mar 31 2012 fgconsole
-rwxr-xr-x 1 root root 57968 Mar 31 2012 dumpkeys
-rwxr-xr-x 1 root root 9648 Mar 31 2012 chvt
-rwxr-xr-x 1 root root 67624 Apr 1 2012 mt-gnu
-rwxr-xr-x 1 root root 138888 Apr 1 2012 cpio
lrwxrwxrwx 1 root root 4 Apr 3 2012 rbash -> bash
-rwxr-xr-x 1 root root 920788 Apr 3 2012 bash
-rwxr-xr-x 1 root root 71412 Apr 10 2012 ss
-rwxr-xr-x 1 root root 253984 Apr 10 2012 ip
-rwxr-xr-x 1 root root 30480 Apr 13 2012 plymouth-upstart-bridge
-rwxr-xr-x 1 root root 34420 Apr 13 2012 plymouth
-rwxr-xr-x 1 root root 12052 Apr 19 2012 setupcon
-rwxr-xr-x 1 root root 254 Apr 26 2012 running-in-container
-rwxr-xr-x 1 root root 16005 Apr 26 2012 initctl2dot
-rwxr-xr-x 1 root root 5935 Apr 26 2012 init-checkconf
-rwxr-xr-x 1 root root 5508 Jun 14 08:13 vmmouse_detect
-rwxr-xr-x 1 root root 1011 Jul 5 18:59 cgroups-mount
Edit number 5:
I have confirmed that coreutils will affect the mentioned binaries, and I did do sudo apt-get upgrade, so this matter is solved. I will leave this thread here as evidence to a case of false positives for the future generations. Cheers!
I had a webserver at home hosting some misc pages, and in an effort I wanted to strengthen the security so I reinstalled the computer with 12.04.1 LTS.
Then, before allowing the big, bad internet on I installed nginx, node.js, redis, twistd (for hosting my sites) and used apparmor profiling on them. I then installed tripwire and rkhunter.
This is an report from tripwire the day before opening up the site to the internet (inbound HTTP port 80):
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report
Report generated by: root
Report created on: Tue Nov 27 18:32:34 2012
Database last updated on: Tue Nov 27 18:24:46 2012
================================================== =============================
Report Summary:
================================================== =============================
Host name: al
Host IP address: 127.0.1.1
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/al.twd
Command line used: /usr/sbin/tripwire --check --quiet --email-report
================================================== =============================
Rule Summary:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
Other binaries 66 0 0 0
Tripwire Binaries 100 0 0 0
Other libraries 66 0 0 0
Root file-system executables 100 0 0 0
Tripwire Data Files 100 0 0 0
System boot changes 100 0 0 0
Root file-system libraries 100 0 0 0
(/lib)
Critical system boot files 100 0 0 0
Other configuration files 66 0 0 0
(/etc)
Boot Scripts 100 0 0 0
Security Control 66 0 0 0
Root config files 100 0 0 0
Devices & Kernel information 100 0 0 0
(/dev)
Invariant Directories 66 0 0 0
Total objects scanned: 28319
Total violations found: 0
================================================== =============================
Object Detail:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
No violations.
================================================== =============================
Error Report:
================================================== =============================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
And this is what shocked me this morning
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report
Report generated by: root
Report created on: Wed Nov 28 06:54:16 2012
Database last updated on: Tue Nov 27 18:24:46 2012
================================================== =============================
Report Summary:
================================================== =============================
Host name: al
Host IP address: 127.0.1.1
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/al.twd
Command line used: /usr/sbin/tripwire --check --quiet --email-report
================================================== =============================
Rule Summary:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
* Other binaries 66 0 0 86
Tripwire Binaries 100 0 0 0
* Other libraries 66 0 0 32
* Root file-system executables 100 0 0 29
Tripwire Data Files 100 0 0 0
* System boot changes 100 2 0 0
Root file-system libraries 100 0 0 0
(/lib)
Critical system boot files 100 0 0 0
* Other configuration files 66 0 0 8
(/etc)
Boot Scripts 100 0 0 0
Security Control 66 0 0 0
Root config files 100 0 0 0
Devices & Kernel information 100 0 0 0
(/dev)
Invariant Directories 66 0 0 0
Total objects scanned: 28321
Total violations found: 157
================================================== =============================
Object Detail:
================================================== =============================
-------------------------------------------------------------------------------
Section: Unix File System
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Rule Name: Other binaries (/usr/sbin)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 2
----------------------------------------
Modified object name: /usr/sbin
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 16:23:14 2012 Wed Nov 28 06:52:33 2012
Modified object name: /usr/sbin/chroot
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537128 548611
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
-------------------------------------------------------------------------------
Rule Name: Other libraries (/usr/lib)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 32
----------------------------------------
Modified object name: /usr/lib/apt/methods
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:44:35 2012 Wed Nov 28 06:53:04 2012
Modified object name: /usr/lib/apt/methods/bzip2
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526192 537193
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 BgDHXZ A0qJUX
* MD5 BLpj77p6HOvWMceh27u9bk D4n5G6dxJGIl1E3S6PpBD+
Modified object name: /usr/lib/apt/methods/cdrom
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526185 537192
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 A0r8N+ CTOo/R
* MD5 Bc0mhTMMVBm2ZulT5fC8us C+00qZrKfMNLESgjTzV/iP
Modified object name: /usr/lib/apt/methods/copy
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526190 537190
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 CBVO6h AvJbEL
* MD5 C5hZI1GBfIF5O8zvkXLWzp A4Isi2RwIm52AEWgrh1oL9
Modified object name: /usr/lib/apt/methods/file
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526188 537188
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 DPI9tq Ah/RKT
* MD5 CuMNl09Z8c3l5lSYbTpIhV DHBvZAkAAKM53hdFDJmKTO
Modified object name: /usr/lib/apt/methods/ftp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526186 537191
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 A82jMT DWovV0
* MD5 BA8bu1WfFBLhX138yPzXW7 C84juYSJB99vB2lzO/EZ0S
Modified object name: /usr/lib/apt/methods/gpgv
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526183 537194
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 CrACJf BaQfuZ
* MD5 AtQtyBMIUlk7eKwQeuIvh4 AVYilH4ugzNtgNkhMMltvs
Modified object name: /usr/lib/apt/methods/gzip
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526187 537186
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 A7iB0O CHeoDu
* MD5 AQxZOrg1KOFm9X1WkvW2yG DEXdnY08zLfiwF1vEh3vvP
Modified object name: /usr/lib/apt/methods/http
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526189 537189
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 DvGxl4 A0qroy
* MD5 DD3vIq01DL209A5NzYe2Gu D2svHlp5GwqO/1jdgGYXQk
Modified object name: /usr/lib/apt/methods/https
Property: Expected Observed
------------- ----------- -----------
* Inode Number 527003 526112
* Modify Time Mon Oct 15 11:58:40 2012 Mon Nov 19 21:33:19 2012
* CRC32 DpTpJU D7nt/F
* MD5 CkmIudnrAfxvRqGqwdekLI BBLIHITP+4ODpgK7SxbEqF
Modified object name: /usr/lib/apt/methods/lzma
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526202 537203
* Modify Time Mon Oct 15 11:56:14 2012 Mon Nov 19 21:30:36 2012
Modified object name: /usr/lib/apt/methods/mirror
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526191 537196
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 D6kvg0 CKsQvW
* MD5 DKhzLkb0G2tFKPhUAdPzny DQPtkuPg1hBZ4vhkLl2Z6n
Modified object name: /usr/lib/apt/methods/rred
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526182 537187
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 DXeQ8A C9fDKv
* MD5 BWEudDEEABm3bJEek6DUNC B3EZ7v+rKIHqR6nLRLth/k
Modified object name: /usr/lib/apt/methods/rsh
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526184 537195
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 CDscDk C0qB5v
* MD5 Bq+KgSWfqkmbYVWxP1T19Z DKhUPISHCvmpEaD84dBKzs
Modified object name: /usr/lib/apt/methods/ssh
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526205 537205
* Modify Time Mon Oct 15 11:56:14 2012 Mon Nov 19 21:30:36 2012
Modified object name: /usr/lib/apt/methods/xz
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526199 537201
* Modify Time Mon Oct 15 11:56:14 2012 Mon Nov 19 21:30:36 2012
Modified object name: /usr/lib/apt/solvers
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:44:24 2012 Wed Nov 28 06:53:03 2012
Modified object name: /usr/lib/apt/solvers/apt
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526960 526115
* Modify Time Mon Oct 15 11:58:34 2012 Mon Nov 19 21:33:12 2012
Modified object name: /usr/lib/apt/solvers/dump
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526955 526110
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 AEv7gh B3wWHQ
* MD5 BgmxWkLy38aWUuIoSwvKxW BTqsZSQO6aIGv0GqUNem/L
Modified object name: /usr/lib/coreutils
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:41:08 2012 Wed Nov 28 06:52:33 2012
Modified object name: /usr/lib/coreutils/libstdbuf.so
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537129 548612
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/lib/dpkg/methods/apt
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:42:25 2012 Wed Nov 28 06:52:51 2012
Modified object name: /usr/lib/dpkg/methods/apt/desc.apt
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526177 537183
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/install
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526178 537182
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/names
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526180 537185
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/setup
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526179 537184
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/dpkg/methods/apt/update
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526181 537181
* Modify Time Mon Oct 15 11:56:37 2012 Mon Nov 19 21:31:02 2012
Modified object name: /usr/lib/i386-linux-gnu
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 17:24:19 2012 Wed Nov 28 06:53:01 2012
Modified object name: /usr/lib/i386-linux-gnu/libapt-inst.so.1.4
Property: Expected Observed
------------- ----------- -----------
* Inode Number 527480 526099
* Modify Time Mon Oct 15 11:56:02 2012 Mon Nov 19 21:30:22 2012
Modified object name: /usr/lib/i386-linux-gnu/libapt-inst.so.1.4.0
Property: Expected Observed
------------- ----------- -----------
* Inode Number 527475 526094
* Modify Time Mon Oct 15 11:58:19 2012 Mon Nov 19 21:32:55 2012
* CRC32 A4liD5 CbzVPL
* MD5 AeSfNMsi7WGU29XLQ7tO/b AQZG47LDVnXwDlsCQp5qPs
Modified object name: /usr/lib/i386-linux-gnu/libapt-pkg.so.4.12
Property: Expected Observed
------------- ----------- -----------
* Inode Number 524252 537103
* Modify Time Mon Oct 15 11:55:58 2012 Mon Nov 19 21:30:18 2012
Modified object name: /usr/lib/i386-linux-gnu/libapt-pkg.so.4.12.0
Property: Expected Observed
------------- ----------- -----------
* Inode Number 524250 537102
* Modify Time Mon Oct 15 11:58:12 2012 Mon Nov 19 21:32:47 2012
* CRC32 DyIMDZ CbFKdc
* MD5 BH8ObpuMXcMBEghoNZ3Vd9 AMLEo282AQDXDqUUOeXbis
-------------------------------------------------------------------------------
Rule Name: Other binaries (/usr/bin)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 84
----------------------------------------
Modified object name: /usr/bin
Property: Expected Observed
------------- ----------- -----------
* Size 24576 28672
* Modify Time Tue Nov 27 17:25:21 2012 Wed Nov 28 06:53:03 2012
* Blocks 56 64
Modified object name: /usr/bin/[
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537107 548590
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/apt-cache
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526055 524207
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 B18SEk C1XklM
* MD5 AGK7D0T787x8dkc94ioWdS B2m7Ch/OC90P6DEsvdNqop
Modified object name: /usr/bin/apt-cdrom
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526051 524209
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 AlJKge CgM/4+
* MD5 DFKmCZlgYoLfYuFvzPVap1 CDz8oCw9Jx2G4IPwFM4b/6
Modified object name: /usr/bin/apt-config
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526049 524203
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 Bb/J86 D7vP0Y
* MD5 DHTCSMZTVf9srULPXEOeNj AogCPFSFHbmhaCcETq8wAC
Modified object name: /usr/bin/apt-extracttemplates
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526932 524756
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 BAwPzN AYOE8k
* MD5 BzQ5W1BDusucs6B+cS7Gvr B4DIAABHtgJ9Y2bIMEXAk8
Modified object name: /usr/bin/apt-ftparchive
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526929 524755
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 CxqL+q C691fQ
* MD5 Ac3xno1dalhvUZY2iTJ3Ed BfbCu8hgGgivPyII+YztEI
Modified object name: /usr/bin/apt-get
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526056 524204
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 ALqMcQ B9AKgs
* MD5 BIwkHAkymj6LcCDXqgAbqF DDD3GPHlUvVcMFy3VQUi9I
Modified object name: /usr/bin/apt-internal-solver
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526930 524757
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:14 2012
* CRC32 BpP83X DGqjqd
* MD5 D9M4aQcE2NzFcZheW+yxdb DMm+/ZSH18EnuNChENjWRP
Modified object name: /usr/bin/apt-key
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526054 524208
* Modify Time Mon Oct 15 11:56:26 2012 Mon Nov 19 21:30:49 2012
Modified object name: /usr/bin/apt-mark
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526052 524201
* Modify Time Mon Oct 15 11:58:26 2012 Mon Nov 19 21:33:03 2012
* CRC32 AGbkDY BpQwN3
* MD5 BrV+AL0hjTQA1VaULoDOYo Ax1IFaWeqMGKJqganKpItU
Modified object name: /usr/bin/apt-sortpkgs
Property: Expected Observed
------------- ----------- -----------
* Inode Number 526931 524754
* Modify Time Mon Oct 15 11:58:35 2012 Mon Nov 19 21:33:13 2012
* CRC32 B9ID0X CvPujh
* MD5 BfrfCVKjmmShmzbb1QkVIS ALJKgZ+IfylvGA4DZznp4r
Modified object name: /usr/bin/arch
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537124 548607
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/base64
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537093 548576
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/basename
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537058 548541
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/chcon
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537098 548581
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/cksum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537126 548609
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/comm
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537116 548599
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/csplit
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537069 548552
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/cut
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537059 548542
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/dircolors
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537106 548589
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/dirname
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537113 548596
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/du
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537123 548606
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/env
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537084 548567
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/expand
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537065 548548
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/expr
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537076 548559
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/factor
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537111 548594
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/fmt
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537105 548588
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/fold
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537100 548583
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/groups
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537125 548608
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/head
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537082 548565
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/hostid
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537110 548593
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/id
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537102 548585
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/install
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537104 548587
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
* CRC32 AdoZI9 A74Een
* MD5 AxPt7+GPPvMsKkWXC5KxhD As7bfGqdzQG9vEmCK1fTPZ
Modified object name: /usr/bin/join
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537089 548572
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/link
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537066 548549
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/logname
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537092 548575
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/md5sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537088 548571
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/md5sum.textutils
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537239 548722
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:29 2012
Modified object name: /usr/bin/mkfifo
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537087 548570
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nice
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537078 548561
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nl
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537115 548598
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nohup
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537114 548597
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/nproc
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537094 548577
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/od
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537077 548560
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/paste
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537090 548573
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/pathchk
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537101 548584
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/pinky
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537096 548579
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/pr
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537060 548543
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/printenv
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537068 548551
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/printf
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537122 548605
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/ptx
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537121 548604
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/runcon
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537075 548558
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/seq
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537072 548555
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha1sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537120 548603
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha224sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537083 548566
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha256sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 530781 548540
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha384sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537063 548546
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sha512sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537118 548601
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/shred
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537086 548569
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/shuf
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537074 548557
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sort
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537095 548578
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/split
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537079 548562
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/stat
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537103 548586
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/stdbuf
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537119 548602
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/sum
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537108 548591
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tac
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537073 548556
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tail
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537091 548574
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tee
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537109 548592
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/test
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537117 548600
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/timeout
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537067 548550
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/touch
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537241 548724
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:29 2012
Modified object name: /usr/bin/tr
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537062 548545
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/truncate
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537081 548564
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tsort
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537112 548595
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/tty
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537097 548580
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/unexpand
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537061 548544
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/uniq
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537070 548553
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/unlink
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537080 548563
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/users
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537127 548610
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/wc
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537099 548582
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/who
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537071 548554
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/whoami
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537085 548568
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /usr/bin/yes
Property: Expected Observed
------------- ----------- -----------
* Inode Number 537064 548547
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
-------------------------------------------------------------------------------
Rule Name: System boot changes (/var/log)
Severity Level: 100
-------------------------------------------------------------------------------
----------------------------------------
Added Objects: 2
----------------------------------------
Added object name: /var/log/unattended-upgrades/unattended-upgrades-dpkg_2012-11-28_06:52:20.987578.log
Added object name: /var/log/kern.log.4.gz
-------------------------------------------------------------------------------
Rule Name: Other configuration files (/etc)
Severity Level: 66
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 8
----------------------------------------
Modified object name: /etc
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 16:27:26 2012 Wed Nov 28 06:53:10 2012
Modified object name: /etc/apparmor.d
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 18:19:29 2012 Tue Nov 27 23:44:25 2012
Modified object name: /etc/apparmor.d/usr.local.bin.redis-server
Property: Expected Observed
------------- ----------- -----------
* Inode Number 276226 274423
* Size 266 322
* Modify Time Tue Nov 27 17:52:30 2012 Tue Nov 27 20:41:47 2012
* CRC32 Ce3NR8 A6wWs8
* MD5 AhAFAXOzmaQFH4ZDSyDBHT DbrvmuufcHfvisGzPc74vz
Modified object name: /etc/apt
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Oct 30 21:42:32 2012 Wed Nov 28 06:52:59 2012
Modified object name: /etc/apt/apt.conf.d
Property: Expected Observed
------------- ----------- -----------
* Modify Time Thu Nov 8 06:48:20 2012 Wed Nov 28 06:52:58 2012
Modified object name: /etc/cron.daily
Property: Expected Observed
------------- ----------- -----------
* Modify Time Thu Nov 15 06:31:40 2012 Wed Nov 28 06:52:58 2012
Modified object name: /etc/ld.so.cache
Property: Expected Observed
------------- ----------- -----------
* Size 21921 22410
* Modify Time Tue Nov 27 16:27:26 2012 Wed Nov 28 06:53:10 2012
* CRC32 CNWCY8 D/e2rY
* MD5 ClRaIMuorTW4t/iD46D5mt CIPjIaM9dP9mNdmXmi/b9d
Modified object name: /etc/logrotate.d
Property: Expected Observed
------------- ----------- -----------
* Modify Time Thu Nov 15 06:31:39 2012 Wed Nov 28 06:52:59 2012
-------------------------------------------------------------------------------
Rule Name: Root file-system executables (/bin)
Severity Level: 100
-------------------------------------------------------------------------------
----------------------------------------
Modified Objects: 29
----------------------------------------
Modified object name: /bin
Property: Expected Observed
------------- ----------- -----------
* Modify Time Tue Nov 27 06:47:01 2012 Wed Nov 28 06:52:33 2012
Modified object name: /bin/cat
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138373 146762
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/chgrp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138360 146749
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/chmod
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138357 146746
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/chown
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138358 146747
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/cp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138366 146755
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
* CRC32 Bu6s8I B4mwhn
* MD5 DE5eAbouaQ8uEyAwMpZ5DZ DmU0Th2y/SUmAkLgfE+iDi
Modified object name: /bin/date
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138369 146758
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/dd
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138362 146751
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/df
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138355 146744
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/dir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138354 146743
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/echo
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138363 146752
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/false
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138350 146739
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/ln
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138367 146756
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/ls
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138365 146754
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mkdir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138370 146759
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mknod
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138359 146748
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mktemp
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138349 146738
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/mv
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138361 146750
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
* CRC32 CGYJkk CDxCrf
* MD5 CUUdarXDqX8pskb8LvpTyD BT10HV9Tk8LopoqHl1ITXt
Modified object name: /bin/pwd
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138352 146741
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/readlink
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138353 146742
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/rm
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138364 146753
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/rmdir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138346 146735
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/sleep
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138348 146737
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/stty
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138371 146760
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/sync
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138351 146740
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/touch
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138368 146757
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/true
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138347 146736
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/uname
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138372 146761
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
Modified object name: /bin/vdir
Property: Expected Observed
------------- ----------- -----------
* Inode Number 138356 146745
* Modify Time Tue Oct 2 05:25:21 2012 Mon Nov 19 23:25:28 2012
================================================== =============================
Error Report:
================================================== =============================
No Errors
-------------------------------------------------------------------------------
*** End of report ***
Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.
less rkhunter.log|grep -A 5 Warning
[13:44:19] Info: Emailing warnings to 'xxx@xx.com' using command '/usr/bin/mail -s "[rkhunter] Warnings found for ${HOST_NAME}"'
[13:44:19] Info: X will be automatically detected
[13:44:19] Info: Found the 'basename' command: /usr/bin/basename
[13:44:19] Info: Found the 'diff' command: /usr/bin/diff
[13:44:19] Info: Found the 'dirname' command: /usr/bin/dirname
[13:44:19] Info: Found the 'file' command: /usr/bin/file
--
[13:45:04] /usr/sbin/chroot [ Warning ]
[13:45:04] Warning: The file properties have changed:
[13:45:04] File: /usr/sbin/chroot
[13:45:04] Current inode: 548611 Stored inode: 537128
[13:45:04] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:04] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:05] /usr/sbin/cron [ OK ]
--
[13:45:20] /usr/bin/basename [ Warning ]
[13:45:20] Warning: The file properties have changed:
[13:45:20] File: /usr/bin/basename
[13:45:20] Current inode: 548541 Stored inode: 537058
[13:45:20] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:20] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:21] /usr/bin/chattr [ OK ]
--
[13:45:23] /usr/bin/cut [ Warning ]
[13:45:23] Warning: The file properties have changed:
[13:45:23] File: /usr/bin/cut
[13:45:23] Current inode: 548542 Stored inode: 537059
[13:45:23] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:23] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:24] /usr/bin/diff [ OK ]
[13:45:24] /usr/bin/dirname [ Warning ]
[13:45:24] Warning: The file properties have changed:
[13:45:24] File: /usr/bin/dirname
[13:45:25] Current inode: 548596 Stored inode: 537113
[13:45:25] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:25] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:25] /usr/bin/dpkg [ OK ]
--
[13:45:26] /usr/bin/du [ Warning ]
[13:45:27] Warning: The file properties have changed:
[13:45:27] File: /usr/bin/du
[13:45:27] Current inode: 548606 Stored inode: 537123
[13:45:27] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:27] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:28] /usr/bin/env [ Warning ]
[13:45:28] Warning: The file properties have changed:
[13:45:28] File: /usr/bin/env
[13:45:28] Current inode: 548567 Stored inode: 537084
[13:45:28] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:28] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:29] /usr/bin/file [ OK ]
--
[13:45:31] /usr/bin/groups [ Warning ]
[13:45:31] Warning: The file properties have changed:
[13:45:31] File: /usr/bin/groups
[13:45:32] Current inode: 548608 Stored inode: 537125
[13:45:32] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:32] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:32] Info: Found file '/usr/bin/groups': it is whitelisted for the 'script replacement' check.
[13:45:32] /usr/bin/head [ Warning ]
[13:45:33] Warning: The file properties have changed:
[13:45:33] File: /usr/bin/head
[13:45:33] Current inode: 548565 Stored inode: 537082
[13:45:33] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:33] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:34] /usr/bin/id [ Warning ]
[13:45:34] Warning: The file properties have changed:
[13:45:34] File: /usr/bin/id
[13:45:34] Current inode: 548585 Stored inode: 537102
[13:45:34] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:34] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:35] /usr/bin/killall [ OK ]
--
[13:45:41] /usr/bin/md5sum [ Warning ]
[13:45:41] Warning: The file properties have changed:
[13:45:41] File: /usr/bin/md5sum
[13:45:42] Current inode: 548571 Stored inode: 537088
[13:45:42] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:42] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:42] /usr/bin/mlocate [ OK ]
--
[13:45:48] /usr/bin/runcon [ Warning ]
[13:45:48] Warning: The file properties have changed:
[13:45:48] File: /usr/bin/runcon
[13:45:48] Current inode: 548558 Stored inode: 537075
[13:45:48] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:48] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:49] /usr/bin/sha1sum [ Warning ]
[13:45:49] Warning: The file properties have changed:
[13:45:49] File: /usr/bin/sha1sum
[13:45:49] Current inode: 548603 Stored inode: 537120
[13:45:50] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:50] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:50] /usr/bin/sha224sum [ Warning ]
[13:45:50] Warning: The file properties have changed:
[13:45:50] File: /usr/bin/sha224sum
[13:45:50] Current inode: 548566 Stored inode: 537083
[13:45:51] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:51] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:51] /usr/bin/sha256sum [ Warning ]
[13:45:51] Warning: The file properties have changed:
[13:45:51] File: /usr/bin/sha256sum
[13:45:51] Current inode: 548540 Stored inode: 530781
[13:45:52] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:52] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:52] /usr/bin/sha384sum [ Warning ]
[13:45:52] Warning: The file properties have changed:
[13:45:52] File: /usr/bin/sha384sum
[13:45:53] Current inode: 548546 Stored inode: 537063
[13:45:53] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:53] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:53] /usr/bin/sha512sum [ Warning ]
[13:45:54] Warning: The file properties have changed:
[13:45:54] File: /usr/bin/sha512sum
[13:45:54] Current inode: 548601 Stored inode: 537118
[13:45:54] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:54] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:55] /usr/bin/size [ OK ]
[13:45:56] /usr/bin/sort [ Warning ]
[13:45:56] Warning: The file properties have changed:
[13:45:56] File: /usr/bin/sort
[13:45:56] Current inode: 548578 Stored inode: 537095
[13:45:56] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:56] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:57] /usr/bin/stat [ Warning ]
[13:45:57] Warning: The file properties have changed:
[13:45:57] File: /usr/bin/stat
[13:45:57] Current inode: 548586 Stored inode: 537103
[13:45:57] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:45:57] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:45:58] /usr/bin/strace [ OK ]
--
[13:46:00] /usr/bin/tail [ Warning ]
[13:46:00] Warning: The file properties have changed:
[13:46:00] File: /usr/bin/tail
[13:46:00] Current inode: 548574 Stored inode: 537091
[13:46:00] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:00] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:01] /usr/bin/test [ Warning ]
[13:46:01] Warning: The file properties have changed:
[13:46:01] File: /usr/bin/test
[13:46:01] Current inode: 548600 Stored inode: 537117
[13:46:02] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:02] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:02] /usr/bin/top [ OK ]
[13:46:03] /usr/bin/touch [ Warning ]
[13:46:03] Warning: The file properties have changed:
[13:46:03] File: /usr/bin/touch
[13:46:03] Current inode: 548724 Stored inode: 537241
[13:46:03] Current file modification time: 1353363929 (19-nov-2012 23:25:29)
[13:46:03] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:04] /usr/bin/tr [ Warning ]
[13:46:04] Warning: The file properties have changed:
[13:46:04] File: /usr/bin/tr
[13:46:04] Current inode: 548545 Stored inode: 537062
[13:46:04] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:04] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:05] /usr/bin/uniq [ Warning ]
[13:46:05] Warning: The file properties have changed:
[13:46:05] File: /usr/bin/uniq
[13:46:05] Current inode: 548553 Stored inode: 537070
[13:46:05] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:05] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:06] /usr/bin/users [ Warning ]
[13:46:06] Warning: The file properties have changed:
[13:46:06] File: /usr/bin/users
[13:46:06] Current inode: 548610 Stored inode: 537127
[13:46:07] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:07] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:07] /usr/bin/vmstat [ OK ]
--
[13:46:09] /usr/bin/wc [ Warning ]
[13:46:09] Warning: The file properties have changed:
[13:46:09] File: /usr/bin/wc
[13:46:09] Current inode: 548582 Stored inode: 537099
[13:46:09] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:09] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:10] /usr/bin/wget [ OK ]
--
[13:46:12] /usr/bin/who [ Warning ]
[13:46:12] Warning: The file properties have changed:
[13:46:12] File: /usr/bin/who
[13:46:12] Current inode: 548554 Stored inode: 537071
[13:46:13] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:13] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:13] /usr/bin/whoami [ Warning ]
[13:46:13] Warning: The file properties have changed:
[13:46:13] File: /usr/bin/whoami
[13:46:13] Current inode: 548568 Stored inode: 537085
[13:46:14] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:14] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:14] /usr/bin/mawk [ OK ]
--
[13:46:32] /bin/cat [ Warning ]
[13:46:32] Warning: The file properties have changed:
[13:46:33] File: /bin/cat
[13:46:33] Current inode: 146762 Stored inode: 138373
[13:46:33] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:33] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:33] /bin/chmod [ Warning ]
[13:46:33] Warning: The file properties have changed:
[13:46:34] File: /bin/chmod
[13:46:34] Current inode: 146746 Stored inode: 138357
[13:46:34] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:34] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:34] /bin/chown [ Warning ]
[13:46:34] Warning: The file properties have changed:
[13:46:34] File: /bin/chown
[13:46:35] Current inode: 146747 Stored inode: 138358
[13:46:35] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:35] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:35] /bin/cp [ Warning ]
[13:46:35] Warning: The file properties have changed:
[13:46:35] File: /bin/cp
[13:46:35] Current hash: 38b30c83d39c4c192fd4f59a6fec5fabf1a043b7
[13:46:36] Stored hash : 159f0d346148b8d2146d56ff445d4b44ab852bef
[13:46:36] Current inode: 146755 Stored inode: 138366
[13:46:36] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
--
[13:46:36] /bin/date [ Warning ]
[13:46:36] Warning: The file properties have changed:
[13:46:36] File: /bin/date
[13:46:37] Current inode: 146758 Stored inode: 138369
[13:46:37] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:37] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:37] /bin/df [ Warning ]
[13:46:37] Warning: The file properties have changed:
[13:46:37] File: /bin/df
[13:46:37] Current inode: 146744 Stored inode: 138355
[13:46:38] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:38] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:38] /bin/dmesg [ OK ]
[13:46:39] /bin/echo [ Warning ]
[13:46:39] Warning: The file properties have changed:
[13:46:39] File: /bin/echo
[13:46:39] Current inode: 146752 Stored inode: 138363
[13:46:39] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:39] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:40] /bin/ed [ OK ]
--
[13:46:48] /bin/ls [ Warning ]
[13:46:48] Warning: The file properties have changed:
[13:46:49] File: /bin/ls
[13:46:49] Current inode: 146754 Stored inode: 138365
[13:46:49] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:49] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:49] /bin/lsmod [ OK ]
[13:46:50] /bin/mktemp [ Warning ]
[13:46:50] Warning: The file properties have changed:
[13:46:50] File: /bin/mktemp
[13:46:50] Current inode: 146738 Stored inode: 138349
[13:46:50] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:51] Stored file modification time : 1349148321 (02-okt-2012 05:25:22)
[13:46:51] /bin/more [ OK ]
--
[13:46:52] /bin/mv [ Warning ]
[13:46:52] Warning: The file properties have changed:
[13:46:52] File: /bin/mv
[13:46:52] Current hash: 6c0c3d6b439466e6a4ff0894ddbfae9a8d4a93de
[13:46:52] Stored hash : 9d28a65fb8cfb59169dda335482ab117ac0085bc
[13:46:52] Current inode: 146750 Stored inode: 138361
[13:46:53] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
--
[13:46:54] /bin/pwd [ Warning ]
[13:46:54] Warning: The file properties have changed:
[13:46:54] File: /bin/pwd
[13:46:54] Current inode: 146741 Stored inode: 138352
[13:46:54] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:54] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:55] /bin/readlink [ Warning ]
[13:46:55] Warning: The file properties have changed:
[13:46:55] File: /bin/readlink
[13:46:55] Current inode: 146742 Stored inode: 138353
[13:46:55] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:55] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:56] /bin/sed [ OK ]
--
[13:46:58] /bin/touch [ Warning ]
[13:46:58] Warning: The file properties have changed:
[13:46:58] File: /bin/touch
[13:46:58] Current inode: 146757 Stored inode: 138368
[13:46:58] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:58] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:46:58] /bin/uname [ Warning ]
[13:46:59] Warning: The file properties have changed:
[13:46:59] File: /bin/uname
[13:46:59] Current inode: 146761 Stored inode: 138372
[13:46:59] Current file modification time: 1353363928 (19-nov-2012 23:25:28)
[13:46:59] Stored file modification time : 1349148321 (02-okt-2012 05:25:21)
[13:47:00] /bin/which [ OK ]
Note:
During the setup, I had some changes in my tripwire/rkhunter reports but those were all explainable like "you added the binary nginx to path blabla" this is the first time I get REALLY strange reports.
Note number 2:
When I do md5sum (on my main computer AND laptop on /bin/ls) I get the same sum
1925024a82af85d47991e1f050523357 /bin/ls
and I have 12.04.1 LTS, can anyone confirm this?
Another strange thing is that the /bin folder seems to have a lot of binaries changed at the same date as my main desktop computer, so I suspect a false positive:
ls -ltr /bin
lrwxrwxrwx 1 root root 7 nov 16 19:00 static-sh -> busybox
-rwxr-xr-x 1 root root 1647864 nov 16 19:00 busybox
-rwxr-xr-x 1 root root 104512 nov 19 23:25 vdir
-rwxr-xr-x 1 root root 26180 nov 19 23:25 uname
-rwxr-xr-x 1 root root 22044 nov 19 23:25 true
-rwxr-xr-x 1 root root 54980 nov 19 23:25 touch
-rwxr-xr-x 1 root root 22052 nov 19 23:25 sync
-rwxr-xr-x 1 root root 58992 nov 19 23:25 stty
-rwxr-xr-x 1 root root 26156 nov 19 23:25 sleep
-rwxr-xr-x 1 root root 34376 nov 19 23:25 rmdir
-rwxr-xr-x 1 root root 54912 nov 19 23:25 rm
-rwxr-xr-x 1 root root 34404 nov 19 23:25 readlink
-rwxr-xr-x 1 root root 26220 nov 19 23:25 pwd
-rwxr-xr-x 1 root root 112488 nov 19 23:25 mv
-rwxr-xr-x 1 root root 34436 nov 19 23:25 mktemp
-rwxr-xr-x 1 root root 30272 nov 19 23:25 mknod
-rwxr-xr-x 1 root root 42624 nov 19 23:25 mkdir
-rwxr-xr-x 1 root root 104508 nov 19 23:25 ls
-rwxr-xr-x 1 root root 46720 nov 19 23:25 ln
-rwxr-xr-x 1 root root 22044 nov 19 23:25 false
-rwxr-xr-x 1 root root 26152 nov 19 23:25 echo
-rwxr-xr-x 1 root root 104508 nov 19 23:25 dir
-rwxr-xr-x 1 root root 79632 nov 19 23:25 df
-rwxr-xr-x 1 root root 54984 nov 19 23:25 dd
-rwxr-xr-x 1 root root 54916 nov 19 23:25 date
-rwxr-xr-x 1 root root 120708 nov 19 23:25 cp
-rwxr-xr-x 1 root root 54936 nov 19 23:25 chown
-rwxr-xr-x 1 root root 50804 nov 19 23:25 chmod
-rwxr-xr-x 1 root root 54928 nov 19 23:25 chgrp
-rwxr-xr-x 1 root root 46764 nov 19 23:25 cat
in order to test my hypothesis I even booted up an old laptop, did ls -ltr /bin and the apt-get upgrade and then ls -ltr /bin and then I noticed that my /bin/ files have changed with the same dates "nov 19" as on my other boxed... This confirms my hypothesis. I will post the logs here:
total 8664
-rwxr-xr-x 1 root root 4788 Mar 17 2008 fgetty-login2
-rwxr-xr-x 1 root root 2656 Mar 17 2008 fgetty-login
-rwxr-xr-x 1 root root 9604 Mar 17 2008 checkpassword
-rwxr-xr-x 1 root root 170016 Dec 3 2010 nano
-rwxr-xr-x 1 root root 59472 Apr 30 2011 sed
-rwxr-xr-x 4 root root 13852 May 26 2011 ypdomainname
-rwxr-xr-x 4 root root 13852 May 26 2011 nisdomainname
-rwxr-xr-x 1 root root 13848 May 26 2011 hostname
-rwxr-xr-x 4 root root 13852 May 26 2011 domainname
-rwxr-xr-x 4 root root 13852 May 26 2011 dnsdomainname
lrwxrwxrwx 1 root root 20 Jun 9 2011 mt -> /etc/alternatives/mt
lrwxrwxrwx 1 root root 20 Jun 9 2011 nc -> /etc/alternatives/nc
lrwxrwxrwx 1 root root 24 Jun 9 2011 netcat -> /etc/alternatives/netcat
lrwxrwxrwx 1 root root 4 Jun 9 2011 rnano -> nano
-rwxr-xr-x 1 root root 26152 Jul 1 2011 nc.openbsd
-rwxr-xr-x 1 root root 7506 Aug 10 2011 lesspipe
lrwxrwxrwx 1 root root 8 Aug 10 2011 lessfile -> lesspipe
-rwxr-xr-x 1 root root 14460 Aug 10 2011 lesskey
-rwxr-xr-x 1 root root 9640 Aug 10 2011 lessecho
-rwxr-xr-x 1 root root 141240 Aug 10 2011 less
-rwxr-xr-x 1 root root 42612 Oct 17 2011 ed
-rwsr-xr-x 1 root root 39116 Nov 8 2011 ping6
-rwsr-xr-x 1 root root 34740 Nov 8 2011 ping
-rwxr-xr-x 1 root root 5540 Nov 20 2011 lsmod
-rwxr-xr-x 1 root root 87900 Dec 12 2011 ps
-rwxr-xr-x 1 root root 17968 Dec 12 2011 kill
-rwxr-xr-x 1 root root 1297 Dec 15 2011 bzmore
-rwxr-xr-x 1 root root 3642 Dec 15 2011 bzgrep
-rwxr-xr-x 1 root root 4877 Dec 15 2011 bzexe
-rwxr-xr-x 1 root root 2140 Dec 15 2011 bzdiff
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzless -> bzmore
-rwxr-xr-x 1 root root 9596 Dec 15 2011 bzip2recover
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzip2
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzfgrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzegrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzcmp -> bzdiff
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzcat
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bunzip2
-rwxr-xr-x 1 root root 153692 Dec 16 2011 grep
-rwxr-xr-x 1 root root 108500 Dec 16 2011 fgrep
-rwxr-xr-x 1 root root 149596 Dec 16 2011 egrep
-rwxr-xr-x 1 root root 30788 Dec 18 2011 setfacl
-rwxr-xr-x 1 root root 22500 Dec 18 2011 getfacl
-rwxr-xr-x 1 root root 13800 Dec 18 2011 chacl
-rwxr-xr-x 1 root root 5015 Feb 9 2012 znew
-rwxr-xr-x 1 root root 2502 Feb 9 2012 zmore
-rwxr-xr-x 1 root root 1797 Feb 9 2012 zless
-rwxr-xr-x 1 root root 5986 Feb 9 2012 zgrep
-rwxr-xr-x 1 root root 2078 Feb 9 2012 zforce
-rwxr-xr-x 1 root root 121 Feb 9 2012 zfgrep
-rwxr-xr-x 1 root root 121 Feb 9 2012 zegrep
-rwxr-xr-x 1 root root 4534 Feb 9 2012 zdiff
-rwxr-xr-x 1 root root 1721 Feb 9 2012 zcmp
-rwxr-xr-x 1 root root 1939 Feb 9 2012 zcat
-rwxr-xr-x 2 root root 2251 Feb 9 2012 uncompress
-rwxr-xr-x 1 root root 5937 Feb 9 2012 gzexe
-rwxr-xr-x 2 root root 2251 Feb 9 2012 gunzip
-rwxr-xr-x 1 root root 86040 Feb 9 2012 gzip
-rwxr-xr-x 1 root root 22120 Feb 9 2012 whiptail
-rwxr-xr-x 1 root root 9732 Mar 2 2012 ulockmgr_server
-rwsr-xr-x 1 root root 26252 Mar 2 2012 fusermount
lrwxrwxrwx 1 root root 4 Mar 29 2012 sh -> dash
-rwxr-xr-x 1 root root 100284 Mar 29 2012 dash
-rwxr-xr-x 1 root root 946 Mar 29 2012 which
-rwxr-xr-x 1 root root 9580 Mar 29 2012 tempfile
-rwxr-xr-x 1 root root 14044 Mar 29 2012 run-parts
-rwsr-xr-x 1 root root 67720 Mar 30 2012 umount
-rwxr-xr-x 1 root root 13836 Mar 30 2012 tailf
-rwsr-xr-x 1 root root 88760 Mar 30 2012 mount
-rwxr-xr-x 1 root root 34492 Mar 30 2012 more
-rwxr-xr-x 1 root root 43312 Mar 30 2012 lsblk
-rwxr-xr-x 1 root root 34848 Mar 30 2012 findmnt
-rwxr-xr-x 1 root root 22020 Mar 30 2012 dmesg
-rwxr-xr-x 1 root root 305968 Mar 31 2012 tar
-rwxr-xr-x 1 root root 113920 Mar 31 2012 netstat
-rwxr-xr-x 1 root root 2762 Mar 31 2012 unicode_start
lrwxrwxrwx 1 root root 6 Mar 31 2012 open -> openvt
-rwxr-xr-x 1 root root 38612 Mar 31 2012 setfont
-rwxr-xr-x 1 root root 13844 Mar 31 2012 openvt
-rwxr-xr-x 1 root root 86856 Mar 31 2012 loadkeys
-rwxr-xr-x 1 root root 9652 Mar 31 2012 kbd_mode
-rwxr-xr-x 1 root root 9656 Mar 31 2012 fgconsole
-rwxr-xr-x 1 root root 57968 Mar 31 2012 dumpkeys
-rwxr-xr-x 1 root root 9648 Mar 31 2012 chvt
-rwxr-xr-x 1 root root 67624 Apr 1 2012 mt-gnu
-rwxr-xr-x 1 root root 138888 Apr 1 2012 cpio
lrwxrwxrwx 1 root root 4 Apr 3 2012 rbash -> bash
-rwxr-xr-x 1 root root 920788 Apr 3 2012 bash
-rwxr-xr-x 1 root root 71412 Apr 10 2012 ss
-rwxr-xr-x 1 root root 253984 Apr 10 2012 ip
-rwxr-xr-x 1 root root 30480 Apr 13 2012 plymouth-upstart-bridge
-rwxr-xr-x 1 root root 34420 Apr 13 2012 plymouth
lrwxrwxrwx 1 root root 7 Apr 13 2012 static-sh -> busybox
-rwxr-xr-x 1 root root 1639672 Apr 13 2012 busybox
-rwxr-xr-x 1 root root 12052 Apr 19 2012 setupcon
-rwxr-xr-x 1 root root 254 Apr 26 2012 running-in-container
-rwxr-xr-x 1 root root 16005 Apr 26 2012 initctl2dot
-rwxr-xr-x 1 root root 5935 Apr 26 2012 init-checkconf
-rwxr-xr-x 1 root root 5508 Jun 14 08:13 vmmouse_detect
-rwxr-xr-x 1 root root 1011 Jul 5 18:59 cgroups-mount
-rwxr-xr-x 1 root root 599 Jul 5 19:09 cgroups-umount
-rwxr-xr-x 1 root root 30832 Jul 17 01:59 fuser
lrwxrwxrwx 1 root root 14 Jul 26 20:23 pidof -> /sbin/killall5
-rwxr-xr-x 1 root root 5544 Jul 26 20:23 mountpoint
-rwxr-xr-x 1 root root 42656 Sep 11 06:12 ntfswipe
-rwxr-xr-x 1 root root 34176 Sep 11 06:12 ntfstruncate
-rwxr-xr-x 1 root root 30124 Sep 11 06:12 ntfsmove
-rwxr-xr-x 1 root root 25992 Sep 11 06:12 ntfsmftalloc
-rwxr-xr-x 1 root root 31204 Sep 11 06:12 ntfsls
-rwxr-xr-x 1 root root 58812 Sep 11 06:12 ntfsinfo
-rwxr-xr-x 1 root root 42420 Sep 11 06:12 ntfsfix
-rwxr-xr-x 1 root root 21856 Sep 11 06:12 ntfsdump_logfile
-rwxr-xr-x 1 root root 42484 Sep 11 06:12 ntfsdecrypt
-rwxr-xr-x 1 root root 34220 Sep 11 06:12 ntfscmp
-rwxr-xr-x 1 root root 34220 Sep 11 06:12 ntfscluster
-rwxr-xr-x 1 root root 30072 Sep 11 06:12 ntfsck
-rwxr-xr-x 1 root root 26028 Sep 11 06:12 ntfscat
-rwxr-xr-x 1 root root 17760 Sep 11 06:12 ntfs-3g.usermap
-rwxr-xr-x 1 root root 66940 Sep 11 06:12 ntfs-3g.secaudit
-rwxr-xr-x 1 root root 9620 Sep 11 06:12 ntfs-3g.probe
-rwxr-xr-x 1 root root 58992 Sep 11 06:12 ntfs-3g
-rwxr-xr-x 1 root root 63068 Sep 11 06:12 lowntfs-3g
-rwsr-xr-x 1 root root 31116 Sep 13 00:29 su
-rwxr-xr-x 1 root root 43312 Sep 13 00:29 login
-rwxr-xr-x 1 root root 104512 Oct 2 05:25 vdir
-rwxr-xr-x 1 root root 26180 Oct 2 05:25 uname
-rwxr-xr-x 1 root root 22044 Oct 2 05:25 true
-rwxr-xr-x 1 root root 54980 Oct 2 05:25 touch
-rwxr-xr-x 1 root root 22052 Oct 2 05:25 sync
-rwxr-xr-x 1 root root 58992 Oct 2 05:25 stty
-rwxr-xr-x 1 root root 26156 Oct 2 05:25 sleep
-rwxr-xr-x 1 root root 34376 Oct 2 05:25 rmdir
-rwxr-xr-x 1 root root 54912 Oct 2 05:25 rm
-rwxr-xr-x 1 root root 34404 Oct 2 05:25 readlink
-rwxr-xr-x 1 root root 26220 Oct 2 05:25 pwd
-rwxr-xr-x 1 root root 112488 Oct 2 05:25 mv
-rwxr-xr-x 1 root root 34436 Oct 2 05:25 mktemp
-rwxr-xr-x 1 root root 30272 Oct 2 05:25 mknod
-rwxr-xr-x 1 root root 42624 Oct 2 05:25 mkdir
-rwxr-xr-x 1 root root 104508 Oct 2 05:25 ls
-rwxr-xr-x 1 root root 46720 Oct 2 05:25 ln
-rwxr-xr-x 1 root root 22044 Oct 2 05:25 false
-rwxr-xr-x 1 root root 26152 Oct 2 05:25 echo
-rwxr-xr-x 1 root root 104508 Oct 2 05:25 dir
-rwxr-xr-x 1 root root 79632 Oct 2 05:25 df
-rwxr-xr-x 1 root root 54984 Oct 2 05:25 dd
-rwxr-xr-x 1 root root 54916 Oct 2 05:25 date
-rwxr-xr-x 1 root root 120708 Oct 2 05:25 cp
-rwxr-xr-x 1 root root 54936 Oct 2 05:25 chown
-rwxr-xr-x 1 root root 50804 Oct 2 05:25 chmod
-rwxr-xr-x 1 root root 54928 Oct 2 05:25 chgrp
-rwxr-xr-x 1 root root 46764 Oct 2 05:25 cat
-rwxr-xr-x 1 root root 9536 Oct 3 19:03 dbus-uuidgen
-rwxr-xr-x 1 root root 439704 Oct 3 19:03 dbus-daemon
-rwxr-xr-x 1 root root 9544 Oct 3 19:03 dbus-cleanup-sockets
anon@eee:~$ sudo apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
apt apt-transport-https apt-utils bamfdaemon busybox-initramfs busybox-static coreutils gir1.2-gtk-3.0
gnome-accessibility-themes gnome-themes-standard im-switch indicator-messages indicator-status-provider-mc5
indicator-status-provider-pidgin libapt-inst1.4 libapt-pkg4.12 libbamf0 libbamf3-0 libgail-3-0 libgtk-3-0 libgtk-3-bin
libgtk-3-common libindicator-messages-status-provider1 light-themes lxc make python-ubuntu-sso-client seahorse skype
skype-bin ubuntu-sso-client ubuntu-sso-client-gtk ubuntu-sso-client-qt
33 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/42.5 MB of archives.
After this operation, 683 kB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Extracting templates from packages: 100%
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace coreutils 8.13-3ubuntu3.1 (using .../coreutils_8.13-3ubuntu3.2_i386.deb) ...
Unpacking replacement coreutils ...
Processing triggers for man-db ...
Processing triggers for install-info ...
Setting up coreutils (8.13-3ubuntu3.2) ...
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace libapt-pkg4.12 0.8.16~exp12ubuntu10.5 (using .../libapt-pkg4.12_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement libapt-pkg4.12 ...
Setting up libapt-pkg4.12 (0.8.16~exp12ubuntu10.6) ...
Processing triggers for libc-bin ...
ldconfig deferred processing now taking place
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace apt 0.8.16~exp12ubuntu10.5 (using .../apt_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement apt ...
Processing triggers for man-db ...
Setting up apt (0.8.16~exp12ubuntu10.6) ...
gpg: key 437D05B5: "Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>" not changed
gpg: key FBB75451: "Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>" not changed
gpg: key C0B21F32: "Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>" not changed
gpg: key EFE21092: "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" not changed
gpg: Total number processed: 4
gpg: unchanged: 4
(Reading database ... 511779 files and directories currently installed.)
Preparing to replace libapt-inst1.4 0.8.16~exp12ubuntu10.5 (using .../libapt-inst1.4_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement libapt-inst1.4 ...
Preparing to replace libbamf3-0 0.2.118-0ubuntu0.2 (using .../libbamf3-0_0.2.118-0ubuntu0.3_i386.deb) ...
Unpacking replacement libbamf3-0 ...
Preparing to replace libgail-3-0 3.4.2-0ubuntu0.4 (using .../libgail-3-0_3.4.2-0ubuntu0.5_i386.deb) ...
Unpacking replacement libgail-3-0 ...
Preparing to replace libgtk-3-bin 3.4.2-0ubuntu0.4 (using .../libgtk-3-bin_3.4.2-0ubuntu0.5_i386.deb) ...
Leaving 'diversion of /usr/sbin/update-icon-caches to /usr/sbin/update-icon-caches.gtk2 by libgtk-3-bin'
Leaving 'diversion of /usr/share/man/man8/update-icon-caches.8.gz to /usr/share/man/man8/update-icon-caches.gtk2.8.gz by libgtk-3-bin'
Unpacking replacement libgtk-3-bin ...
Preparing to replace libgtk-3-0 3.4.2-0ubuntu0.4 (using .../libgtk-3-0_3.4.2-0ubuntu0.5_i386.deb) ...
Unpacking replacement libgtk-3-0 ...
Preparing to replace libgtk-3-common 3.4.2-0ubuntu0.4 (using .../libgtk-3-common_3.4.2-0ubuntu0.5_all.deb) ...
Unpacking replacement libgtk-3-common ...
Preparing to replace libbamf0 0.2.118-0ubuntu0.2 (using .../libbamf0_0.2.118-0ubuntu0.3_i386.deb) ...
Unpacking replacement libbamf0 ...
Preparing to replace bamfdaemon 0.2.118-0ubuntu0.2 (using .../bamfdaemon_0.2.118-0ubuntu0.3_i386.deb) ...
Unpacking replacement bamfdaemon ...
Preparing to replace ubuntu-sso-client-qt 3.0.2-0ubuntu2 (using .../ubuntu-sso-client-qt_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement ubuntu-sso-client-qt ...
Preparing to replace gir1.2-gtk-3.0 3.4.2-0ubuntu0.4 (using .../gir1.2-gtk-3.0_3.4.2-0ubuntu0.5_i386.deb) ...
Unpacking replacement gir1.2-gtk-3.0 ...
Preparing to replace ubuntu-sso-client-gtk 3.0.2-0ubuntu2 (using .../ubuntu-sso-client-gtk_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement ubuntu-sso-client-gtk ...
Preparing to replace ubuntu-sso-client 3.0.2-0ubuntu2 (using .../ubuntu-sso-client_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement ubuntu-sso-client ...
Preparing to replace python-ubuntu-sso-client 3.0.2-0ubuntu2 (using .../python-ubuntu-sso-client_3.0.2-0ubuntu3_all.deb) ...
Unpacking replacement python-ubuntu-sso-client ...
Preparing to replace apt-utils 0.8.16~exp12ubuntu10.5 (using .../apt-utils_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement apt-utils ...
Preparing to replace busybox-initramfs 1:1.18.5-1ubuntu4 (using .../busybox-initramfs_1%3a1.18.5-1ubuntu4.1_i386.deb) ...
Unpacking replacement busybox-initramfs ...
Preparing to replace apt-transport-https 0.8.16~exp12ubuntu10.5 (using .../apt-transport-https_0.8.16~exp12ubuntu10.6_i386.deb) ...
Unpacking replacement apt-transport-https ...
Preparing to replace busybox-static 1:1.18.5-1ubuntu4 (using .../busybox-static_1%3a1.18.5-1ubuntu4.1_i386.deb) ...
Unpacking replacement busybox-static ...
Preparing to replace gnome-accessibility-themes 3.4.1-0ubuntu1.1 (using .../gnome-accessibility-themes_3.4.1-0ubuntu1.2_all.deb) ...
Unpacking replacement gnome-accessibility-themes ...
Preparing to replace gnome-themes-standard 3.4.1-0ubuntu1.1 (using .../gnome-themes-standard_3.4.1-0ubuntu1.2_i386.deb) ...
Unpacking replacement gnome-themes-standard ...
Preparing to replace im-switch 1.20ubuntu5 (using .../im-switch_1.20ubuntu5.1_all.deb) ...
update-alternatives: using /etc/X11/xinit/xinput.d/default-xim to provide /etc/X11/xinit/xinput.d/all_ALL (xinput-all_ALL) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/none to provide /etc/X11/xinit/xinput.d/all_ALL (xinput-all_ALL) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/th-gtk to provide /etc/X11/xinit/xinput.d/th_TH (xinput-th_TH) in auto mode.
Unpacking replacement im-switch ...
Preparing to replace libindicator-messages-status-provider1 0.6.0-0ubuntu1 (using .../libindicator-messages-status-provider1_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement libindicator-messages-status-provider1 ...
Preparing to replace indicator-messages 0.6.0-0ubuntu1 (using .../indicator-messages_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement indicator-messages ...
Preparing to replace indicator-status-provider-mc5 0.6.0-0ubuntu1 (using .../indicator-status-provider-mc5_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement indicator-status-provider-mc5 ...
Preparing to replace indicator-status-provider-pidgin 0.6.0-0ubuntu1 (using .../indicator-status-provider-pidgin_0.6.0-0ubuntu2_i386.deb) ...
Unpacking replacement indicator-status-provider-pidgin ...
Preparing to replace light-themes 0.1.9.1-0ubuntu1.1 (using .../light-themes_0.1.9.1-0ubuntu1.2_all.deb) ...
Unpacking replacement light-themes ...
Preparing to replace lxc 0.7.5-3ubuntu63 (using .../lxc_0.7.5-3ubuntu65_i386.deb) ...
Unpacking replacement lxc ...
Preparing to replace make 3.81-8.1ubuntu1 (using .../make_3.81-8.1ubuntu1.1_i386.deb) ...
Unpacking replacement make ...
Preparing to replace seahorse 3.2.2-0ubuntu2 (using .../seahorse_3.2.2-0ubuntu2.1_i386.deb) ...
Unpacking replacement seahorse ...
Preparing to replace skype 4.0.0.8-0oneiric1 (using .../skype_4.1.0.20.0-0ubuntu0.12.04.1_i386.deb) ...
Unpacking replacement skype ...
Preparing to replace skype-bin 4.0.0.8-0oneiric1 (using .../skype-bin_4.1.0.20.0-0ubuntu0.12.04.1_i386.deb) ...
Unpacking replacement skype-bin ...
Processing triggers for man-db ...
Processing triggers for libglib2.0-0 ...
Processing triggers for gconf2 ...
Processing triggers for desktop-file-utils ...
Processing triggers for gnome-menus ...
Processing triggers for menu ...
Processing triggers for ureadahead ...
ureadahead will be reprofiled on next reboot
Processing triggers for hicolor-icon-theme ...
Setting up libapt-inst1.4 (0.8.16~exp12ubuntu10.6) ...
Setting up libgtk-3-common (3.4.2-0ubuntu0.5) ...
Setting up libgtk-3-0 (3.4.2-0ubuntu0.5) ...
Setting up bamfdaemon (0.2.118-0ubuntu0.3) ...
Rebuilding /usr/share/applications/bamf.index...
Setting up libbamf3-0 (0.2.118-0ubuntu0.3) ...
Setting up libgail-3-0 (3.4.2-0ubuntu0.5) ...
Setting up libgtk-3-bin (3.4.2-0ubuntu0.5) ...
Setting up libbamf0 (0.2.118-0ubuntu0.3) ...
Setting up gir1.2-gtk-3.0 (3.4.2-0ubuntu0.5) ...
Setting up python-ubuntu-sso-client (3.0.2-0ubuntu3) ...
Setting up ubuntu-sso-client (3.0.2-0ubuntu3) ...
Setting up ubuntu-sso-client-qt (3.0.2-0ubuntu3) ...
Setting up ubuntu-sso-client-gtk (3.0.2-0ubuntu3) ...
Setting up apt-utils (0.8.16~exp12ubuntu10.6) ...
Setting up busybox-initramfs (1:1.18.5-1ubuntu4.1) ...
Setting up apt-transport-https (0.8.16~exp12ubuntu10.6) ...
Setting up busybox-static (1:1.18.5-1ubuntu4.1) ...
Setting up gnome-accessibility-themes (3.4.1-0ubuntu1.2) ...
Setting up gnome-themes-standard (3.4.1-0ubuntu1.2) ...
Setting up im-switch (1.20ubuntu5.1) ...
Installing new version of config file /etc/X11/Xsession.d/80im-switch ...
update-alternatives: using /etc/X11/xinit/xinput.d/default to provide /etc/X11/xinit/xinput.d/all_ALL (xinput-all_ALL) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/lo-gtk to provide /etc/X11/xinit/xinput.d/lo_TH (xinput-lo_TH) in auto mode.
update-alternatives: using /etc/X11/xinit/xinput.d/th-xim to provide /etc/X11/xinit/xinput.d/th_TH (xinput-th_TH) in auto mode.
Setting up libindicator-messages-status-provider1 (0.6.0-0ubuntu2) ...
Setting up indicator-messages (0.6.0-0ubuntu2) ...
Setting up indicator-status-provider-mc5 (0.6.0-0ubuntu2) ...
Setting up indicator-status-provider-pidgin (0.6.0-0ubuntu2) ...
Setting up light-themes (0.1.9.1-0ubuntu1.2) ...
Setting up lxc (0.7.5-3ubuntu65) ...
Installing new version of config file /etc/init/lxc-net.conf ...
* Restarting DNS forwarder and DHCP server dnsmasq [ OK ]
Setting up make (3.81-8.1ubuntu1.1) ...
Setting up seahorse (3.2.2-0ubuntu2.1) ...
Setting up skype-bin (4.1.0.20.0-0ubuntu0.12.04.1) ...
Setting up skype (4.1.0.20.0-0ubuntu0.12.04.1) ...
Processing triggers for libc-bin ...
ldconfig deferred processing now taking place
Processing triggers for menu ...
anon@eee:~$ ls -ltr /bin
total 8672
-rwxr-xr-x 1 root root 4788 Mar 17 2008 fgetty-login2
-rwxr-xr-x 1 root root 2656 Mar 17 2008 fgetty-login
-rwxr-xr-x 1 root root 9604 Mar 17 2008 checkpassword
-rwxr-xr-x 1 root root 170016 Dec 3 2010 nano
-rwxr-xr-x 1 root root 59472 Apr 30 2011 sed
-rwxr-xr-x 4 root root 13852 May 26 2011 ypdomainname
-rwxr-xr-x 4 root root 13852 May 26 2011 nisdomainname
-rwxr-xr-x 1 root root 13848 May 26 2011 hostname
-rwxr-xr-x 4 root root 13852 May 26 2011 domainname
-rwxr-xr-x 4 root root 13852 May 26 2011 dnsdomainname
lrwxrwxrwx 1 root root 20 Jun 9 2011 mt -> /etc/alternatives/mt
lrwxrwxrwx 1 root root 20 Jun 9 2011 nc -> /etc/alternatives/nc
lrwxrwxrwx 1 root root 24 Jun 9 2011 netcat -> /etc/alternatives/netcat
lrwxrwxrwx 1 root root 4 Jun 9 2011 rnano -> nano
-rwxr-xr-x 1 root root 26152 Jul 1 2011 nc.openbsd
-rwxr-xr-x 1 root root 7506 Aug 10 2011 lesspipe
lrwxrwxrwx 1 root root 8 Aug 10 2011 lessfile -> lesspipe
-rwxr-xr-x 1 root root 14460 Aug 10 2011 lesskey
-rwxr-xr-x 1 root root 9640 Aug 10 2011 lessecho
-rwxr-xr-x 1 root root 141240 Aug 10 2011 less
-rwxr-xr-x 1 root root 42612 Oct 17 2011 ed
-rwsr-xr-x 1 root root 39116 Nov 8 2011 ping6
-rwsr-xr-x 1 root root 34740 Nov 8 2011 ping
-rwxr-xr-x 1 root root 5540 Nov 20 2011 lsmod
-rwxr-xr-x 1 root root 87900 Dec 12 2011 ps
-rwxr-xr-x 1 root root 17968 Dec 12 2011 kill
-rwxr-xr-x 1 root root 1297 Dec 15 2011 bzmore
-rwxr-xr-x 1 root root 3642 Dec 15 2011 bzgrep
-rwxr-xr-x 1 root root 4877 Dec 15 2011 bzexe
-rwxr-xr-x 1 root root 2140 Dec 15 2011 bzdiff
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzless -> bzmore
-rwxr-xr-x 1 root root 9596 Dec 15 2011 bzip2recover
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzip2
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzfgrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzegrep -> bzgrep
lrwxrwxrwx 1 root root 6 Dec 15 2011 bzcmp -> bzdiff
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bzcat
-rwxr-xr-x 3 root root 30216 Dec 15 2011 bunzip2
-rwxr-xr-x 1 root root 153692 Dec 16 2011 grep
-rwxr-xr-x 1 root root 108500 Dec 16 2011 fgrep
-rwxr-xr-x 1 root root 149596 Dec 16 2011 egrep
-rwxr-xr-x 1 root root 30788 Dec 18 2011 setfacl
-rwxr-xr-x 1 root root 22500 Dec 18 2011 getfacl
-rwxr-xr-x 1 root root 13800 Dec 18 2011 chacl
-rwxr-xr-x 1 root root 5015 Feb 9 2012 znew
-rwxr-xr-x 1 root root 2502 Feb 9 2012 zmore
-rwxr-xr-x 1 root root 1797 Feb 9 2012 zless
-rwxr-xr-x 1 root root 5986 Feb 9 2012 zgrep
-rwxr-xr-x 1 root root 2078 Feb 9 2012 zforce
-rwxr-xr-x 1 root root 121 Feb 9 2012 zfgrep
-rwxr-xr-x 1 root root 121 Feb 9 2012 zegrep
-rwxr-xr-x 1 root root 4534 Feb 9 2012 zdiff
-rwxr-xr-x 1 root root 1721 Feb 9 2012 zcmp
-rwxr-xr-x 1 root root 1939 Feb 9 2012 zcat
-rwxr-xr-x 2 root root 2251 Feb 9 2012 uncompress
-rwxr-xr-x 1 root root 5937 Feb 9 2012 gzexe
-rwxr-xr-x 2 root root 2251 Feb 9 2012 gunzip
-rwxr-xr-x 1 root root 86040 Feb 9 2012 gzip
-rwxr-xr-x 1 root root 22120 Feb 9 2012 whiptail
-rwxr-xr-x 1 root root 9732 Mar 2 2012 ulockmgr_server
-rwsr-xr-x 1 root root 26252 Mar 2 2012 fusermount
lrwxrwxrwx 1 root root 4 Mar 29 2012 sh -> dash
-rwxr-xr-x 1 root root 100284 Mar 29 2012 dash
-rwxr-xr-x 1 root root 946 Mar 29 2012 which
-rwxr-xr-x 1 root root 9580 Mar 29 2012 tempfile
-rwxr-xr-x 1 root root 14044 Mar 29 2012 run-parts
-rwsr-xr-x 1 root root 67720 Mar 30 2012 umount
-rwxr-xr-x 1 root root 13836 Mar 30 2012 tailf
-rwsr-xr-x 1 root root 88760 Mar 30 2012 mount
-rwxr-xr-x 1 root root 34492 Mar 30 2012 more
-rwxr-xr-x 1 root root 43312 Mar 30 2012 lsblk
-rwxr-xr-x 1 root root 34848 Mar 30 2012 findmnt
-rwxr-xr-x 1 root root 22020 Mar 30 2012 dmesg
-rwxr-xr-x 1 root root 305968 Mar 31 2012 tar
-rwxr-xr-x 1 root root 113920 Mar 31 2012 netstat
-rwxr-xr-x 1 root root 2762 Mar 31 2012 unicode_start
lrwxrwxrwx 1 root root 6 Mar 31 2012 open -> openvt
-rwxr-xr-x 1 root root 38612 Mar 31 2012 setfont
-rwxr-xr-x 1 root root 13844 Mar 31 2012 openvt
-rwxr-xr-x 1 root root 86856 Mar 31 2012 loadkeys
-rwxr-xr-x 1 root root 9652 Mar 31 2012 kbd_mode
-rwxr-xr-x 1 root root 9656 Mar 31 2012 fgconsole
-rwxr-xr-x 1 root root 57968 Mar 31 2012 dumpkeys
-rwxr-xr-x 1 root root 9648 Mar 31 2012 chvt
-rwxr-xr-x 1 root root 67624 Apr 1 2012 mt-gnu
-rwxr-xr-x 1 root root 138888 Apr 1 2012 cpio
lrwxrwxrwx 1 root root 4 Apr 3 2012 rbash -> bash
-rwxr-xr-x 1 root root 920788 Apr 3 2012 bash
-rwxr-xr-x 1 root root 71412 Apr 10 2012 ss
-rwxr-xr-x 1 root root 253984 Apr 10 2012 ip
-rwxr-xr-x 1 root root 30480 Apr 13 2012 plymouth-upstart-bridge
-rwxr-xr-x 1 root root 34420 Apr 13 2012 plymouth
-rwxr-xr-x 1 root root 12052 Apr 19 2012 setupcon
-rwxr-xr-x 1 root root 254 Apr 26 2012 running-in-container
-rwxr-xr-x 1 root root 16005 Apr 26 2012 initctl2dot
-rwxr-xr-x 1 root root 5935 Apr 26 2012 init-checkconf
-rwxr-xr-x 1 root root 5508 Jun 14 08:13 vmmouse_detect
-rwxr-xr-x 1 root root 1011 Jul 5 18:59 cgroups-mount
Edit number 5:
I have confirmed that coreutils will affect the mentioned binaries, and I did do sudo apt-get upgrade, so this matter is solved. I will leave this thread here as evidence to a case of false positives for the future generations. Cheers!