Hi,

please always reply to the list, so the complete thread is useful for 
others, too!

10.06.2009 09:56, Peter wrote:
> Arno Lehmann wrote:
>> Hi,
>>
>> 09.06.2009 09:03, Peter wrote:
>>  
>>> Hi
>>> I use the verify function to detect for file tampering.
>>> I get the following:
>>>
>>> 29-May 05:05 box-dir JobId 591: File: 
>>> /var/spool/postfix/lib/libnss_nis.so.2
>>> 29-May 05:05 box-dir JobId 591:       st_ino   differ. Cat: 850339 
>>> File: 850337
>>>
>>>
>>> What exactly does this mean ? What does st_ino refer to ?
>>>     
>>
>> st_ino is the file system stat inode number. This is, kind of, the 
>> position in the file system where the file's meta data like 
>> permissions, name, and so on are stored.
>>   
> Thanks a lot, apparently the file mentioned is related to postfix chroot 
> functionality, although I was not able to figure out what exactly is the 
> reason for this file to have been replaced

Well, it might be that the postfix startup script re-builds the chroot 
environment at each start, or after a system upgrade. Without knowing 
more about the actual way the chroot environment is created, it's hard 
to tell anything definite, though...

> ( there was a reboot )
> I think the verify function of bacula is very useful and much easier to 
> use than for example tripwire..

:-)

Arno

> vmail
> 

-- 
Arno Lehmann
IT-Service Lehmann
Sandstr. 6, 49080 Osnabrück
www.its-lehmann.de

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing 
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Bacula-users mailing list
Bacula-users AT lists.sourceforge DOT net
https://lists.sourceforge.net/lists/listinfo/bacula-users