I have two servers based on the very same hardware.
They both run the very same distro (RH4), the very same kernel (uname
-r), and have the very same list of installed packages (rpm -qa)
However, numerous binaries, including /bin/ps, /bin/bash, /bin/ls, and
librairies do not match. They have
* the very same length
* the very same date
but they have different hashes, because they have different contents
(cmp fails)
The differences are inside, not at the end.
We searched for a rootkit, but didn't found any. The two different ps
commands, copied from one to the other, show the same result.
I tried rpm --verify. No probem. However, when replacing one binary by
the one coming from the other host, rpm --verify compains...
Is it normal to have differences in binaries on the same hardware, same
distro, same kernel and same packages ??? Is there a "signature" added
in some binaries ? Might the order of the installation cause such effect ?
The problem is that I have, at the same customer site, two other servers
that are exactly in the same situation, but running CentOS, and I have
the same strange beheaviour...
Does anybody has any suggestions, idea about this strange story ?
--
Brent Frère
Private e-mail: Brent(a)BFrere.net
Postal address: 58, rue d'Esch
L-3720 Rumelange
Grand-Duchy of Luxembourg
European Union
Phone: +352-20.20.22.69
Fax: +352-26.30.05.96
URL:
http://BFrere.net
If you have problem with my digital signature, please install the appropriate authority
certificate by browsing
https://www.cacert.org/certs/root.crt.