what change sudo and su executable file everyday.

r3sistance · 02-20-2017, 03:10 AM

you said you were seeing changes in the md5 checksum results. So showing the difference from one day to the next in the checksum.

gbcbooks · 02-20-2017, 03:37 AM

Quote:

Originally Posted by r3sistance

you said you were seeing changes in the md5 checksum results. So showing the difference from one day to the next in the checksum.

ok, i'll check it tomorrow , i just replace it again.

pan64 · 02-20-2017, 03:39 AM

still would be nice to know if the "other" version belongs to the official package.

Habitual · 02-20-2017, 07:21 AM

I feel compelled to offer
Sudo: you're doing it wrong - PDF @ 171 pages.
Sudo: you're doing it wrong - YouTubeVid @ 1h:11m

I likely need a refresher my damn self.

gbcbooks · 02-20-2017, 07:45 PM

good news ,i add "chattr +i /usr/bin/sudo and /bin/su", and no changed happen today.

r3sistance · 02-21-2017, 12:05 AM

making the files immutable means they can't be updated either, which is also a security risk... also if something was changing sudo and su, it could still be changing other things...

sundialsvcs · 02-22-2017, 09:01 AM

Yes, you definitely have some rogue code operating, and it might be attached to a crontab or to a privileged service script. It could be changing anything, anywhere. You've got to find it.