Community Forums
Connect with us on LinkedIn
[Security] MD5 and Size check
  
+ Reply to Thread
Results 1 to 11 of 11
  1. 05-09-2003 08:32 AM #1
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default [Security] MD5 and Size check

    I wrote a script to make MD5 checksums and Size checks
    on my red hat packages .

    I found some checksum problem on some package
    (using rpm -V util-linux net-tools procps [package)

    frontpage-5.0-0
    SM5...GT /usr/local/frontpage/version5.0/apache-fp/_vti_bin/fpexe
    S.5....T /usr/local/frontpage/version5.0/apache-fp/fpexe.c S.5....T /usr/local/frontpage/we80.cnf

    and
    gd-devel-1.8.4-4

    S.5....T /usr/include/gd.h S.5....T /usr/include/gd_io.h S.5....T /usr/include/gdcache.h S.5....T /usr/include/gdfontg.h S.5....T /usr/include/gdfontl.h S.5....T /usr/include/gdfontmb.h S.5....T /usr/include/gdfonts.h S.5....T /usr/include/gdfontt.h S.5....T /usr/lib/libgd.a

    and
    gd-progs-1.8.4-4

    S.5....T /usr/bin/gd2copypal S.5....T /usr/bin/gd2topng S.5....T /usr/bin/gdparttopng S.5....T /usr/bin/gdtopng S.5....T /usr/bin/pngtogd S.5....T /usr/bin/pngtogd2 S.5....T /usr/bin/webpng

    and
    imap-2001a-10
    S.5....T /usr/sbin/imapd

    and

    pam-0.75-46.7.3
    S.5....T c /etc/pam.d/system-auth

    and

    perl-5.6.1-34.99.6

    S.5....T /usr/bin/a2p S.5....T /usr/bin/perl S.5....T /usr/bin/perl5.6.1 S.5....T /usr/bin/perlbug S.5....T /usr/lib/perl5/5.6.1/ExtUtils/MM_Unix.pm S.5....T /usr/lib/perl5/5.6.1/ExtUtils/MakeMaker.pm S.5....T /usr/lib/perl5/5.6.1/Getopt/Long.pm S.5....T /usr/lib/perl5/5.6.1/Test/Harness.pm S.5....T /usr/lib/perl5/5.6.1/newgetopt.pl


    Is it a good idea to reinstall above package or they were
    modified by WHM/Cpanel ?
    Last edited by Radio_Head; 05-09-2003 at 08:35 AM.
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  2. 05-09-2003 09:30 AM #2
    vishal
    vishal is offline
    Member vishal's Avatar
    Join Date
    Jan 2003
    Location
    India
    Posts
    343

    Default Re: [Security] MD5 and Size check

    Originally posted by Radio_Head
    I wrote a script to make MD5 checksums and Size checks
    on my red hat packages .

    I found some checksum problem on some package
    (using rpm -V util-linux net-tools procps [package)

    frontpage-5.0-0
    SM5...GT /usr/local/frontpage/version5.0/apache-fp/_vti_bin/fpexe
    S.5....T /usr/local/frontpage/version5.0/apache-fp/fpexe.c S.5....T /usr/local/frontpage/we80.cnf

    and
    gd-devel-1.8.4-4

    S.5....T /usr/include/gd.h S.5....T /usr/include/gd_io.h S.5....T /usr/include/gdcache.h S.5....T /usr/include/gdfontg.h S.5....T /usr/include/gdfontl.h S.5....T /usr/include/gdfontmb.h S.5....T /usr/include/gdfonts.h S.5....T /usr/include/gdfontt.h S.5....T /usr/lib/libgd.a

    and
    gd-progs-1.8.4-4

    S.5....T /usr/bin/gd2copypal S.5....T /usr/bin/gd2topng S.5....T /usr/bin/gdparttopng S.5....T /usr/bin/gdtopng S.5....T /usr/bin/pngtogd S.5....T /usr/bin/pngtogd2 S.5....T /usr/bin/webpng

    and
    imap-2001a-10
    S.5....T /usr/sbin/imapd

    and

    pam-0.75-46.7.3
    S.5....T c /etc/pam.d/system-auth

    and

    perl-5.6.1-34.99.6

    S.5....T /usr/bin/a2p S.5....T /usr/bin/perl S.5....T /usr/bin/perl5.6.1 S.5....T /usr/bin/perlbug S.5....T /usr/lib/perl5/5.6.1/ExtUtils/MM_Unix.pm S.5....T /usr/lib/perl5/5.6.1/ExtUtils/MakeMaker.pm S.5....T /usr/lib/perl5/5.6.1/Getopt/Long.pm S.5....T /usr/lib/perl5/5.6.1/Test/Harness.pm S.5....T /usr/lib/perl5/5.6.1/newgetopt.pl


    Is it a good idea to reinstall above package or they were
    modified by WHM/Cpanel ?
    Did u run Chkrootkit !!!

    Regards,
    rh_linuxion

    It is very simple to be Happy but it is very difficult to be Simple.
    Reply With Quote Reply With Quote
  3. 05-09-2003 09:35 AM #3
    jamesbond
    jamesbond is offline
    Member
    Join Date
    Oct 2002
    Posts
    751

    Default

    Radiohead, I saw in another thread you mentioned tripwire.
    Why did you decide not to use tripwire and write your own scripts?
    Reply With Quote Reply With Quote
  4. 05-09-2003 12:55 PM #4
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default

    Originally posted by jamesbond
    Radiohead, I saw in another thread you mentioned tripwire.
    Why did you decide not to use tripwire and write your own scripts?
    Because to do the checksum above are enough
    about 10 php rows (surely you can do that also with a small bash script) . I don't know what does exactly tripwire , I don't think it's only a checksum software . I think that tripwire when find something wrong deny the usage of some program and other things .
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  5. 05-09-2003 01:02 PM #5
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default Re: Re: [Security] MD5 and Size check

    Originally posted by vishal
    Did u run Chkrootkit !!!
    Regards,
    Yes I run chkrootkit very often . However , I repeat you ,
    those packages should be modified by cpanel ,
    try to execute ( version packages are for a red hat 7.2 box)

    rpm -V util-linux net-tools procps frontpage
    rpm -V util-linux net-tools procps gd-devel
    rpm -V util-linux net-tools procps gd-progs
    rpm -V util-linux net-tools procps imap
    rpm -V util-linux net-tools procps pam
    rpm -V util-linux net-tools procps per

    and tell me if you have some S.5 error .
    Probably yes , and I think because these files are modified by cpanel .
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  6. 05-10-2003 09:21 AM #6
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default

    bump
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  7. 05-12-2003 01:54 AM #7
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default

    bump
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  8. 05-13-2003 02:12 AM #8
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default

    I received this reply from darkorb ..

    Yes, cpanel does modify some rpm's so this is something you should not worry about...
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  9. 05-13-2003 10:28 AM #9
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Default

    they told me also that it's not a good idea to force installation of rpm to remove the checksum error , because the file were modified by Cpanel .

    The problem is that I have a list of rpm with checksum errors and I don't which are the rpm that are modified by cpanel and if I have some rpm modified for example from an hacker .

    I think we should know exactly which are the rpm modified
    by cpanel/whm and the new Cpanel/WHM checksum .
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  10. 05-13-2003 11:14 AM #10
    Radio_Head
    Radio_Head is offline
    Member This forum account has been confirmed by cPanel staff to represent a vendor. Radio_Head's Avatar
    Join Date
    Feb 2002
    Posts
    2,064

    Thumbs up

    I opened a ticket and darkorb provided me an ftp cpanel link
    where for every linux distrubution are listed all the rpm modified my Cpanel/WHM . Good ! In this way I can exactly know which are the rpms which could have md5 size checksum errors and rpm which should NOT have md5 size checksum errors .
    █ Stop SPAM & VIRUS :: ASSP Deluxe for cPanel http://www.grscripts.com
    █ ASSP Deluxe is supported by Fritz Borgstedt,ASSP main developer.
    Reply With Quote Reply With Quote
  11. 05-13-2003 01:10 PM #11
    howard
    howard is offline
    Member
    Join Date
    Apr 2003
    Posts
    243

    Default

    yep i like the fact that they provide the src rpms as well so you can roll your own if your parnoid lol (or for ease of use)
    Reply With Quote Reply With Quote
«   license with paypal? | Anonymous FTP Error... »     
Similar Threads & Tags
Similar threads

  1. Check size (physical) of mail queue
    By dgajda in forum E-mail Discussions
    Replies: 0
    Last Post: 05-27-2008, 04:27 PM
  2. security check
    By x2o in forum cPanel and WHM Discussions
    Replies: 4
    Last Post: 07-12-2006, 01:41 PM
  3. Security Check
    By cguimont in forum cPanel and WHM Discussions
    Replies: 3
    Last Post: 09-13-2004, 03:15 AM
  4. password security check
    By techbrink in forum cPanel and WHM Discussions
    Replies: 0
    Last Post: 07-30-2003, 09:59 AM
Linkedin       Facebook       Twitter       RSS       Flickr       YouTube