disable msec warning

loloms893 · 11-18-2005, 06:34 AM

I got the same warnings everyday in the root mailbox (see transcript below) and since I know these files belonging to packages are modified, I would like the warnings not to show up anymore.
I found that these come from a rpm option that checks the files installed but I can't figure out how to tell rpm that these files are ok.
Tried to rebuild the rpm database without success.
Any thoughts ? thanks.

[msec] *** Security Check *** extract:

Security Warning: These files belonging to packages are modified on the system :
- /opt/CA/CAagent/nls/caagent.C
- /opt/CA/CAagent/nls/caagent.de
- /opt/CA/CAagent/nls/caagent.fr
- /opt/CA/CAagent/nls/caagent.ja_euc
- /opt/CA/CAagent/nls/caagent.ja_sjis
- /opt/CA/CAagent/nls/caagentsetup.C
- /opt/CA/CAagent/nls/caagentsetup.de
...
...

and below it continues with:

Security Warning: These config files belonging to packages are modified on the system
:
- /etc/X11/fs/config
- /etc/aliases
- /etc/cups/classes.conf
- /etc/cups/printers.conf
...
...

loloms893 · 11-18-2005, 06:36 AM

Forgot to say: i'm using Mandrake 9.2

spitfire5c · 11-18-2005, 09:33 AM

Hi
Have a look in the file
/etc/security/msec/security.conf

This file has a whole bunch of variables relating to the security level on your system.
One of them should be MAIL_WARN which you could set to no
or alternatively, set MAIL_USER to a user other than root (which IMHO shouldn't be getting this mail anyway)
It may be that the MAIL_USER variable doesn't exist (in which case mail defaults to root) so you'll need to add it if you choose to send to another user - this can be an existing user or you could setup a special user to receive it if you want

Cheers
Ian

loloms893 · 11-21-2005, 02:31 AM

Hi,

I thought about that but these warnings may still be interesting.
I mean if a file is modified some day on the server I'd like to know about it,
but at the present time since I get warnings everyday it is difficult to track if something new happened.

What I would like to know is if there's a way to tell the msec thing that "these files are now ok because I made the changes, so don't warn me about them anymore except if they are modified again"