Today Tripwire (daily cronjob) noticed that over 100 of the binaries and libs on my server were changed last night.
It's the inode number, CRC32 and MD5 that have changed of the following files:

"/usr/sbin/accept"
"/usr/sbin/authconfig"
"/usr/sbin/cupsaddsmb"
"/usr/sbin/dbconverter-2"
"/usr/sbin/dovecot"
"/usr/sbin/ftpshut"
"/usr/sbin/in.proftpd"
"/usr/sbin/lnstat"
"/usr/sbin/lpadmin"
"/usr/sbin/lpc.cups"
"/usr/sbin/lpinfo"
"/usr/sbin/lpmove"
"/usr/sbin/mtr"
"/usr/sbin/postalias"
"/usr/sbin/postcat"
"/usr/sbin/postconf"
"/usr/sbin/postdrop"
"/usr/sbin/postkick"
"/usr/sbin/postlock"
"/usr/sbin/postlog"
"/usr/sbin/postmap"
"/usr/sbin/postqueue"
"/usr/sbin/postsuper"
"/usr/sbin/proftpd"
"/usr/sbin/racoon"
"/usr/sbin/rpc.gssd"
"/usr/sbin/rpc.idmapd"
"/usr/sbin/rpc.svcgssd"
"/usr/sbin/sasl2-shared-mechlist"
"/usr/sbin/sasl2-static-mechlist"
"/usr/sbin/saslauthd"
"/usr/sbin/saslauthd1-checkpass"
"/usr/sbin/sasldblistusers"
"/usr/sbin/sasldblistusers2"
"/usr/sbin/saslpasswd"
"/usr/sbin/saslpasswd2"
"/usr/sbin/sendmail.postfix"
"/usr/sbin/smtp-sink"
"/usr/sbin/smtp-source"
"/usr/sbin/ss"
"/usr/sbin/testsaslauthd"
"/usr/bin/a2p"
"/usr/bin/afs5log"
"/usr/bin/cancel.cups"
"/usr/bin/chacl"
"/usr/bin/cupstestppd"
"/usr/bin/curl"
"/usr/bin/cvs"
"/usr/bin/dir"
"/usr/bin/elinks"
"/usr/bin/fetchmail"
"/usr/bin/ftpcount"
"/usr/bin/ftpdctl"
"/usr/bin/ftptop"
"/usr/bin/ftpwho"
"/usr/bin/getfacl"
"/usr/bin/gnome-open"
"/usr/bin/gnomevfs-cat"
"/usr/bin/gnomevfs-copy"
"/usr/bin/gnomevfs-info"
"/usr/bin/gnomevfs-ls"
"/usr/bin/gnomevfs-mkdir"
"/usr/bin/gnomevfs-mv"
"/usr/bin/gnomevfs-rm"
"/usr/bin/gs"
"/usr/bin/hesinfo"
"/usr/bin/install"
"/usr/bin/kermit"
"/usr/bin/ldapadd"
"/usr/bin/ldapcompare"
"/usr/bin/ldapdelete"
"/usr/bin/ldapmodify"
"/usr/bin/ldapmodrdn"
"/usr/bin/ldappasswd"
"/usr/bin/ldapsearch"
"/usr/bin/ldapwhoami"
"/usr/bin/lftp"
"/usr/bin/lp.cups"
"/usr/bin/lpoptions"
"/usr/bin/lpq.cups"
"/usr/bin/lpr.cups"
"/usr/bin/lprm.cups"
"/usr/bin/lpstat.cups"
"/usr/bin/lynx"
"/usr/bin/mutt"
"/usr/bin/mysql"
"/usr/bin/mysqladmin"
"/usr/bin/mysqlbinlog"
"/usr/bin/mysqlcheck"
"/usr/bin/mysqldump"
"/usr/bin/mysqlimport"
"/usr/bin/mysqlmanager"
"/usr/bin/mysqlmanager-pwgen"
"/usr/bin/mysqlmanagerc"
"/usr/bin/mysqlshow"
"/usr/bin/mysqltest"
"/usr/bin/nmap"
"/usr/bin/openssl"
"/usr/bin/perl"
"/usr/bin/perl5.8.6"
"/usr/bin/php"
"/usr/bin/php-cgi"
"/usr/bin/pine"
"/usr/bin/rpdump"
"/usr/bin/rpload"
"/usr/bin/rpm2cpio"
"/usr/bin/rsync"
"/usr/bin/sasl-sample-client"
"/usr/bin/sasl-sample-server"
"/usr/bin/sasl2-sample-client"
"/usr/bin/sasl2-sample-server"
"/usr/bin/setfacl"
"/usr/bin/slrn"
"/usr/bin/spamc"
"/usr/bin/sslswamp"
"/usr/bin/vdir"
"/usr/bin/wget"

"/usr/lib/autofs/autofs-ldap-auto-master"
"/usr/lib/cups/backend/ipp"
"/usr/lib/cups/backend/lpd"
"/usr/lib/cups/backend/parallel"
"/usr/lib/cups/backend/scsi"
"/usr/lib/cups/backend/serial"
"/usr/lib/cups/backend/socket"
"/usr/lib/cups/backend/usb"
"/usr/lib/cups/cgi-bin/admin.cgi"
"/usr/lib/cups/cgi-bin/classes.cgi"
"/usr/lib/cups/cgi-bin/jobs.cgi"
"/usr/lib/cups/cgi-bin/printers.cgi"
"/usr/lib/libbonoboui-2.so.0.0.0"
"/usr/lib/libcups.so.2"
"/usr/lib/libcurl.so.3.0.0"
"/usr/lib/libdes425.so.3.0"
"/usr/lib/libgnome-2.so.0.1000.0"
"/usr/lib/libgnomeui-2.so.0.1000.0"
"/usr/lib/libgnomevfs-2.so.0.1000.0"
"/usr/lib/libgs.so.7.07"
"/usr/lib/libgssapi_krb5.so.2.2"
"/usr/lib/libhesiod.so.0"
"/usr/lib/libk5crypto.so.3.0"
"/usr/lib/libkrb4.so.2.0"
"/usr/lib/libkrb5.so.3.2"
"/usr/lib/libkrb5support.so.0.0"
"/usr/lib/libldap-2.2.so.7.0.22"
"/usr/lib/libneon.so.24.0.7"
"/usr/lib/libpq.so.4.0"
"/usr/lib/librpm-4.4.so"
"/usr/lib/librpmbuild-4.4.so"
"/usr/lib/librpmdb-4.4.so"
"/usr/lib/librpmio-4.4.so"
"/usr/lib/libsasl.so.7.1.11"
"/usr/lib/libsasl2.so.2.0.20"
"/usr/lib/mysql/libmysqlclient.so.14.0.0"
"/usr/lib/mysql/libmysqlclient_r.so.14.0.0"
"/usr/lib/perl5/5.8.6/i386-linux-thread-multi/CORE/libperl.so"
"/usr/lib/rpm/rpmd"
"/usr/lib/rpm/rpmdb_archive"
"/usr/lib/rpm/rpmdb_checkpoint"
"/usr/lib/rpm/rpmdb_deadlock"
"/usr/lib/rpm/rpmdb_dump"
"/usr/lib/rpm/rpmdb_load"
"/usr/lib/rpm/rpmdb_printlog"
"/usr/lib/rpm/rpmdb_recover"
"/usr/lib/rpm/rpmdb_stat"
"/usr/lib/rpm/rpmdb_svc"
"/usr/lib/rpm/rpmdb_upgrade"
"/usr/lib/rpm/rpmdb_verify"
"/usr/lib/rpm/rpmfile"
"/usr/lib/rpm/rpmi"
"/usr/lib/rpm/rpmk"
"/usr/lib/rpm/rpmq"

In addition to the inode number, CRC32 and MD5, the dates were also changed for the following files (Wed 30 Aug 2006 02:08:29 AM EDT):

"/sbin/ip"
"/sbin/tc"
"/sbin/rtmon"
"/bin/ls"
"/bin/mv"
"/bin/rpm"
"/bin/vi"

I run Fedora Core 4 kernel 2.6.17-1.2142_FC4smp and the whole system was updated with 'yum update' about 2 weeks ago.
My diagnosis would be that a rootkit was installed on my server last night.
Can anybody confirm that this is the only explanation for it, or is there another explanation for having the inodes changed for so many (critical) files?

Chkrootkit and rkhunter don't find anything unusual.
I'm quite sure that my server is not configured to do any automatic updates with something like yum or up2date.

Please help,
SM

It doesn't sounds like a rootkit. It sounds like you have prelink installed and running from a cron job. To confirm this, have a look through the tripwire report and check the modified timestamp for the files. It should correspond to the prelink cronjob. You can control the files that prelink alters with /etc/sysconfig/prelink and /etc/prelink.conf.

There's a summary of what it does at http://www.linuxsecurity.com/content/view/106950 Basically, it "modifies ELF shared libraries and executables, so that far less relocations need to be resolved at runtime and thus programs come up faster".

It looks like you are right. Prelink runs indeed as a daily cronjob, just before the tripwire-check.

"cat /var/log/prelink.log" also helped me to confirm it.
Thank you million times; I would have never figured this out by myself.

Now that I know that prelink messes up Tripwire, I am considering whether it would be better for me to disable prelink. Unfortunately I don't understand much about prelink.

Performance is very important for me, but is prelink of much benefit for an Apache web / MySQL database server system?

Would setting "PRELINKING=no" in /etc/sysconfig/prelink be all that's needed to disable prelink en restore the system no normal operation?

Thank you again for your great help!
SM

I haven't used it for a while, but on the FC4 box I had a while back I ended up disabling it. BTW that's correct - set PRELINKING=no" in /etc/sysconfig/prelink and run prelink -ua to make it effective.

I didn't notice a difference after disabling prelink, but that box was only running a web/ftp server with light to medium traffic. The best way to find out is to run some timings, disable it and re-run the timings.

Hope that helps...