LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-10-2003, 02:10 AM   #1
jlangelier
Member
 
Registered: Jun 2003
Location: Denver, CO
Distribution: Debian
Posts: 95

Rep: Reputation: 15
why did this inode change?


Ran fcheck (similar to tripwire) and got this:

fcheck: "WARNING: ["darkstar"] /etc/mtab [Inodes: 554222 - 554228, Times: Aug 01 17:31 2003 - Aug 09 22:00 2003]"

... which means that for /etc/mtab, the inode changed and the time, but not the contents of the file.

Is this something to worry about? I don't think so, but I'd like to know what that means (the inode change)

Thanks in advance!
 
Old 08-10-2003, 09:49 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Each entity on a Linux FS is represented as a file, and each file is linked to an inode (and each inode is referenced in an index). The inode contains information about the file: have a look with "stat /etc/mtab". /etc/mtab represents all filesystems mounted at the moment, and the contents will be refreshed whenever a filesystem is (u)mounted. So, if the contents don't change, the file is deleted and recreated, which (AFAIK per definition) uses another inode.
I't s good to track changes in /etc, but changes on this particular file alone don't spell thunder and lightning.

If you want to know more, read your systems info pages for stat, touch and shred. Else look up articles on file integrity, Securityfocus.com has some.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
resize / change inode size for partition? tinksmartbstupi Linux - Software 2 05-24-2009 08:54 AM
What constitutes an inode change? un shiza Linux - General 1 09-23-2005 03:28 AM
iNode number, how does it change? saudoi Solaris / OpenSolaris 4 05-22-2005 04:38 AM
What can change an inode number? nc101 Linux - General 2 01-03-2005 10:29 AM
Bash script to change a filename associated with an inode index number. Ziv Programming 22 06-19-2004 08:41 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration