Setuid diffs in security run output

H

hurricane_sh

My security out email today contains the following output, I'm a bit confused, why does it send it today? I didn't install anything important in the past two days, why didn't the system send the info when there are setuid changes? Also, should I be concerned about the text in read? Thanks!


Code: 
 setuid diffs:
--- /var/log/setuid.today       2011-07-20 20:01:15.000000000 -0700
[color="Red"]+++ /tmp/security.zBcqgk1t      2011-07-27 20:01:03.000000000 -0700[/color]
@@ -1,43 +1,43 @@
-   70690 -r-sr-xr-x  1 root  wheel      20416 Feb 17 02:18:44 2011 /bin/rcp
-      69 -r-sr-x---  1 root  operator    9704 Feb 17 02:19:02 2011 /sbin/mksnap_ffs
-      85 -r-sr-xr-x  1 root  wheel      28200 Feb 17 02:19:03 2011 /sbin/ping
-      86 -r-sr-xr-x  1 root  wheel      37240 Feb 17 02:19:03 2011 /sbin/ping6
-      99 -r-sr-x---  1 root  operator   15952 Feb 17 02:19:03 2011 /sbin/shutdown
-57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 17 02:19:20 2011 /usr/bin/at
-57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 17 02:19:20 2011 /usr/bin/atq
-57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 17 02:19:20 2011 /usr/bin/atrm
-57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 17 02:19:20 2011 /usr/bin/batch
-57090164 -r-xr-sr-x  1 root  kmem       12280 Feb 17 02:19:20 2011 /usr/bin/btsockstat
-57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 17 02:19:20 2011 /usr/bin/chfn
-57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 17 02:19:20 2011 /usr/bin/chpass
-57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 17 02:19:20 2011 /usr/bin/chsh
-57090395 -r-sr-xr-x  1 root  wheel      33864 Feb 17 02:19:30 2011 /usr/bin/crontab
-57090215 -r-xr-sr-x  1 root  kmem       21424 Feb 17 02:19:22 2011 /usr/bin/fstat
-57090259 -r-sr-xr-x  1 root  wheel      11472 Feb 17 02:19:23 2011 /usr/bin/lock
-57090262 -r-sr-xr-x  1 root  wheel      25552 Feb 17 02:19:23 2011 /usr/bin/login
-57090399 -r-sr-sr-x  1 root  daemon     34232 Feb 17 02:19:32 2011 /usr/bin/lpq
-57090400 -r-sr-sr-x  1 root  daemon     38272 Feb 17 02:19:32 2011 /usr/bin/lpr
-57090401 -r-sr-sr-x  1 root  daemon     30248 Feb 17 02:19:32 2011 /usr/bin/lprm
-57090288 -r-xr-sr-x  1 root  kmem      152208 Feb 17 02:19:24 2011 /usr/bin/netstat
-57090297 -r-sr-xr-x  1 root  wheel       7032 Feb 17 02:19:24 2011 /usr/bin/opieinfo
-57090299 -r-sr-xr-x  1 root  wheel      14056 Feb 17 02:19:24 2011 /usr/bin/opiepasswd
-57090301 -r-sr-xr-x  2 root  wheel       8176 Feb 17 02:19:24 2011 /usr/bin/passwd
-57090313 -r-sr-xr-x  1 root  wheel      16048 Feb 17 02:19:24 2011 /usr/bin/rlogin
-57090317 -r-sr-xr-x  1 root  wheel      11592 Feb 17 02:19:25 2011 /usr/bin/rsh
-57090331 -r-sr-xr-x  1 root  wheel      16904 Feb 17 02:19:25 2011 /usr/bin/su
-57090374 -r-xr-sr-x  1 root  tty        16104 Feb 17 02:19:26 2011 /usr/bin/wall
-57090381 -r-xr-sr-x  1 root  tty        11696 Feb 17 02:19:26 2011 /usr/bin/write
-57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 17 02:19:20 2011 /usr/bin/ypchfn
-57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 17 02:19:20 2011 /usr/bin/ypchpass
-57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 17 02:19:20 2011 /usr/bin/ypchsh
-57090301 -r-sr-xr-x  2 root  wheel       8176 Feb 17 02:19:24 2011 /usr/bin/yppasswd
-37259322 -r-xr-sr-x  1 root  smmsp     698120 Feb 17 02:19:37 2011 /usr/libexec/sendmail/sendmail
-18467759 -rwxr-sr-x  1 root  maildrop  203392 Jul 20 14:21:16 2011 /usr/local/sbin/postdrop
-18467760 -rwxr-sr-x  1 root  maildrop  200047 Jul 20 14:21:16 2011 /usr/local/sbin/postqueue
-19030046 -r-sr-sr-x  1 root  authpf     20240 Feb 17 02:19:28 2011 /usr/sbin/authpf
-19030131 -r-xr-sr-x  1 root  daemon     54424 Feb 17 02:19:32 2011 /usr/sbin/lpc
-19030196 -r-sr-x---  1 root  network   408712 Feb 17 02:19:36 2011 /usr/sbin/ppp
-19030244 -r-sr-xr-x  1 root  wheel      21080 Feb 17 02:19:38 2011 /usr/sbin/timedc
-19030245 -r-sr-xr-x  1 root  wheel      29456 Feb 17 02:19:38 2011 /usr/sbin/traceroute
-19030246 -r-sr-xr-x  1 root  wheel      24448 Feb 17 02:19:38 2011 /usr/sbin/traceroute6
-19030247 -r-xr-sr-x  1 root  kmem       11632 Feb 17 02:19:38 2011 /usr/sbin/trpt
+   70690 -r-sr-xr-x  1 root  wheel      20416 Feb 16 19:18:44 2011 /bin/rcp
+      69 -r-sr-x---  1 root  operator    9704 Feb 16 19:19:02 2011 /sbin/mksnap_ffs
+      85 -r-sr-xr-x  1 root  wheel      28200 Feb 16 19:19:03 2011 /sbin/ping
+      86 -r-sr-xr-x  1 root  wheel      37240 Feb 16 19:19:03 2011 /sbin/ping6
+      99 -r-sr-x---  1 root  operator   15952 Feb 16 19:19:03 2011 /sbin/shutdown
+57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 16 19:19:20 2011 /usr/bin/at
+57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 16 19:19:20 2011 /usr/bin/atq
+57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 16 19:19:20 2011 /usr/bin/atrm
+57090157 -r-sr-xr-x  4 root  wheel      30056 Feb 16 19:19:20 2011 /usr/bin/batch
+57090164 -r-xr-sr-x  1 root  kmem       12280 Feb 16 19:19:20 2011 /usr/bin/btsockstat
+57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 16 19:19:20 2011 /usr/bin/chfn
+57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 16 19:19:20 2011 /usr/bin/chpass
+57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 16 19:19:20 2011 /usr/bin/chsh
+57090395 -r-sr-xr-x  1 root  wheel      33864 Feb 16 19:19:30 2011 /usr/bin/crontab
+57090215 -r-xr-sr-x  1 root  kmem       21424 Feb 16 19:19:22 2011 /usr/bin/fstat
+57090259 -r-sr-xr-x  1 root  wheel      11472 Feb 16 19:19:23 2011 /usr/bin/lock
+57090262 -r-sr-xr-x  1 root  wheel      25552 Feb 16 19:19:23 2011 /usr/bin/login
+57090399 -r-sr-sr-x  1 root  daemon     34232 Feb 16 19:19:32 2011 /usr/bin/lpq
+57090400 -r-sr-sr-x  1 root  daemon     38272 Feb 16 19:19:32 2011 /usr/bin/lpr
+57090401 -r-sr-sr-x  1 root  daemon     30248 Feb 16 19:19:32 2011 /usr/bin/lprm
+57090288 -r-xr-sr-x  1 root  kmem      152208 Feb 16 19:19:24 2011 /usr/bin/netstat
+57090297 -r-sr-xr-x  1 root  wheel       7032 Feb 16 19:19:24 2011 /usr/bin/opieinfo
+57090299 -r-sr-xr-x  1 root  wheel      14056 Feb 16 19:19:24 2011 /usr/bin/opiepasswd
+57090301 -r-sr-xr-x  2 root  wheel       8176 Feb 16 19:19:24 2011 /usr/bin/passwd
+57090313 -r-sr-xr-x  1 root  wheel      16048 Feb 16 19:19:24 2011 /usr/bin/rlogin
+57090317 -r-sr-xr-x  1 root  wheel      11592 Feb 16 19:19:25 2011 /usr/bin/rsh
+57090331 -r-sr-xr-x  1 root  wheel      16904 Feb 16 19:19:25 2011 /usr/bin/su
+57090374 -r-xr-sr-x  1 root  tty        16104 Feb 16 19:19:26 2011 /usr/bin/wall
+57090381 -r-xr-sr-x  1 root  tty        11696 Feb 16 19:19:26 2011 /usr/bin/write
+57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 16 19:19:20 2011 /usr/bin/ypchfn
+57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 16 19:19:20 2011 /usr/bin/ypchpass
+57090180 -r-sr-xr-x  6 root  wheel      22944 Feb 16 19:19:20 2011 /usr/bin/ypchsh
+57090301 -r-sr-xr-x  2 root  wheel       8176 Feb 16 19:19:24 2011 /usr/bin/yppasswd
+37259322 -r-xr-sr-x  1 root  smmsp     698120 Feb 16 19:19:37 2011 /usr/libexec/sendmail/sendmail
+18467759 -rwxr-sr-x  1 root  maildrop  203392 Jul 20 07:21:16 2011 /usr/local/sbin/postdrop
+18467760 -rwxr-sr-x  1 root  maildrop  200047 Jul 20 07:21:16 2011 /usr/local/sbin/postqueue
+19030046 -r-sr-sr-x  1 root  authpf     20240 Feb 16 19:19:28 2011 /usr/sbin/authpf
+19030131 -r-xr-sr-x  1 root  daemon     54424 Feb 16 19:19:32 2011 /usr/sbin/lpc
+19030196 -r-sr-x---  1 root  network   408712 Feb 16 19:19:36 2011 /usr/sbin/ppp
+19030244 -r-sr-xr-x  1 root  wheel      21080 Feb 16 19:19:38 2011 /usr/sbin/timedc
+19030245 -r-sr-xr-x  1 root  wheel      29456 Feb 16 19:19:38 2011 /usr/sbin/traceroute
+19030246 -r-sr-xr-x  1 root  wheel      24448 Feb 16 19:19:38 2011 /usr/sbin/traceroute6
+19030247 -r-xr-sr-x  1 root  kmem       11632 Feb 16 19:19:38 2011 /usr/sbin/trpt
 
Did you update the base system? Note the difference in the time and date.
 
No, this is a new server (2-week old) but I have finished the configuration one week ago. Also, a 4-month old server (with another ISP) also sent me a similar email. I have never received security output emails with a long list of setuid before, usually only one or two, I can easily it's because I installed something.
 
All these files are related to the base OS so it's not something that would happen when installing a port.

Hmm... Looking more closely at the time/date stamps, there's exactly 7 hours difference. Did you happen to set your timezone correctly?
 
Oh, thank you so much! Yes, I did change the timezone! Sorry for being slow, but where is the 7 hours difference? In the first two lines?
 
Just look at these two:
Code: 
-57090157 -r-sr-xr-x  4 root  wheel      30056 [b]Feb 17 02:19:20 2011[/b] /usr/bin/at

+57090157 -r-sr-xr-x  4 root  wheel      30056 [b]Feb 16 19:19:20 2011[/b] /usr/bin/at
 
You must log in or register to reply here.
Back
Top