Hi,

The MD5 checsum stored in the RPM Databse differs from the checksum calculated by the md5sum utility program. For example, i tried comparing the MD5 checksum value for "/usr/bin/find" in the RPM database with the checksum calculated by the MD5SUM command.

# md5sum /usr/bin/find
2d71bc2313ca11d673946e03dcc90fbd /usr/bin/find



# rpm -qf /usr/bin/find
findutils-4.1.20-7.el4.1

# rpm -q --dump findutils-4.1.20-7.el4.1
/usr/bin/find 49168 1144278767 8fd33efba96b7ee0318a22bd14abdfab 0100755 root root 0 0 0 X
/usr/bin/xargs 11988 1144278767 64bf50fec10d9121020c9a3439c6c7b5 0100755 root root 0 0 0 X
/usr/share/doc/findutils-4.1.20 4096 1144278767 00000000000000000000000000000000 040755 root root 0 0 0 X
....

Does this indicate that my PC has been compromised? I was assuming that the checksum should match. I have a Redhat linux Enterprise Edition 4.0 on a Intel PC

- Sumeet Nigam

Hi.

It's probably because you've got 'prelink' running through cron - it modifies binaries as it runs.

Try 'rpm -V findutils' instead. The rpm verify de-prelinks binaries before it checks them, then re-prelinks them after.

Dave

Hi Dave,

Thanks for your inputs. Indeed prelink was modifying the binary. I have used the command:

prelink -u /usr/bin/find

and calculated the MD5 check sum. It matched with RPM output.

Thanks,
Sumeet Nigam