1 Attachment(s)
Strange file changes after Zimbra installation...
Our tripwire caught this with my test VM (vSphere), so I tried again on a local VirtualBox VM I created specifically for this, and it happened again...
The Zimbra installation seems to cause lots of content changes in files completely unrelated to Zimbra. Has anyone seen this, or might know why it happens? Could there be something in RHEL 6/CentOS 6 (I've tried on both) that might do this "behind the scenes"? This seems unlikely, since tripwire hasn't done this before. While some of these files one would expect to be changed, the vast majority should not IMO. The list is ONLY files with differing MD5 checksums--not new or absent files. I simply did a find+md5sum before and after installing Zimbra. Below is ONLY the /bin files, but one only really needs the first ~5 lines to become concerned, I think. Attached is the complete list.
/bin/lsblk
/bin/tar
/bin/env
/bin/mountpoint
/bin/login
/bin/raw
/bin/true
/bin/sed
/bin/gettext
/bin/cat
/bin/setfont
/bin/chgrp
/bin/kill
/bin/df
/bin/mktemp
/bin/mknod
/bin/mailx
/bin/cgset
/bin/date
/bin/lssubsys
/bin/find
/bin/mv
/bin/uname
/bin/usleep
/bin/nano
/bin/kbd_mode
/bin/taskset
/bin/unlink
/bin/hostname
/bin/fgrep
/bin/dmesg
/bin/grep
/bin/bash
/bin/gzip
/bin/more
/bin/stty
/bin/ls
/bin/cgcreate
/bin/readlink
/bin/sync
/bin/rm
/bin/cgexec
/bin/dbus-send
/bin/dbus-cleanup-sockets
/bin/loadkeys
/bin/pwd
/bin/traceroute
/bin/ipcalc
/bin/cgdelete
/bin/dbus-monitor
/bin/netstat
/bin/sleep
/bin/ps
/bin/chmod
/bin/dumpkeys
/bin/gawk
/bin/dbus-uuidgen
/bin/link
/bin/touch
/bin/cgclassify
/bin/echo
/bin/cp
/bin/false
/bin/ln
/bin/chown
/bin/rmdir
/bin/cgsnapshot
/bin/red
/bin/keyctl
/bin/cgget
/bin/nice
/bin/egrep
/bin/tcsh
/bin/arch
/bin/dash
/bin/mkdir
/bin/plymouth
/bin/dd
/bin/findmnt
/bin/basename
/bin/sort
/bin/setserial
/bin/cut
/bin/vi
/bin/cpio
/bin/rpm
/bin/lscgroup
/bin/ed
...
Josh
