Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I received a mail by checksecurity from my ubuntu 12.04 server with the following content:

--- setuid.today    2012-06-03 06:48:09.892436281 +0200
+++ /var/log/setuid/setuid.new.tmp  2012-06-17 06:47:51.376597730 +0200
@@ -30,2 +30,2 @@
-  131904  4755   2 root       root           71280 Wed May 16 07:23:08.0000000000 2012 ./usr/bin/sudo
-  131904  4755   2 root       root           71280 Wed May 16 07:23:08.0000000000 2012 ./usr/bin/sudoedit
+  143967  4755   2 root       root           71288 Fri Jun  1 05:53:44.0000000000 2012 ./usr/bin/sudo
+  143967  4755   2 root       root           71288 Fri Jun  1 05:53:44.0000000000 2012 ./usr/bin/sudoedit
@@ -42 +42 @@
-  130507   666   1 root       root               0 Sat Jun  2 18:04:57.0752979385 2012 ./var/spool/postfix/dev/urandom
+  130507   666   1 root       root               0 Mon Jun 11 08:47:16.0919802556 2012 ./var/spool/postfix/dev/urandom

First i was worried, then i realized that the change was actually 2 weeks ago, i think there was a sudo-update back then.

Since checksecurity runs in /etc/cron.daily i wondered why i only get that email now. I looked into /var/log/setuid/ and found the following files:

total 32
-rw-r----- 1 root adm   816 Jun 17 06:47 setuid.changes
-rw-r----- 1 root adm   228 Jun  3 06:48 setuid.changes.1.gz
-rw-r----- 1 root adm   328 May 27 06:47 setuid.changes.2.gz
-rw-r----- 1 root root 1248 May 20 06:47 setuid.changes.3.gz
-rw-r----- 1 root adm  4473 Jun 17 06:47 setuid.today
-rw-r----- 1 root adm  4473 Jun  3 06:48 setuid.yesterday

The obvious thing that confuses me is that the file setuid.yesterday is not from yesterday = Jun/16.

Is this a bug?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.