tirpwire says /etc/resolve.conf was modified (why?)

saavik · 06-06-2002, 02:29 AM

as i found out this file holds the ip`s of my ISP`s DNS Server!
why was that changes by root?
i didn`t change it!
is there any service that does that automatically?

-------------------------------------------------------------------------------
Rule Name: Critical configuration files (/etc/resolv.conf)
Severity Level: 100
-------------------------------------------------------------------------------

Modified:
"/etc/resolv.conf"

saavik · 06-06-2002, 02:33 AM

Jun 5 09:39:08 linux modify_resolvconf: Service pppd modified /etc/resolv.conf. See info block in this file

Noerr · 06-06-2002, 05:23 AM

if you use dhcp it will always modify resolv.conf

tyler_durden · 06-10-2002, 10:59 PM

resolv.conf is what your computer uses too keep track of what domain name servers to search for.
as stated, if you use dchp it will change. its not too much of a security risk. but someone could modify it to redect to a malicious ftp server and run some man in the middle attacks.
i really wouldn't worry about it.