SSH and SSHD checksum alerts

[Pizzicato]

Hi,
I'm receiving this mails every now and then:

Trigger: /usr/bin/ssh has been changed on server Master
Trigger status: PROBLEM
Trigger severity: Average
Trigger URL: 

Item values:

1. Checksum of /usr/bin/ssh (Master:vfs.file.cksum[/usr/bin/ssh]): 1145939040

and

Trigger: /usr/sbin/sshd has been changed on server Master
Trigger status: PROBLEM
Trigger severity: Average
Trigger URL: 

Item values:

1. Checksum of /usr/sbin/sshd (Master:vfs.file.cksum[/usr/sbin/sshd]): 184550857

I got a little scared thinking that maybe I had been hacked, but i've run rkhunter and everything seems to be OK...

Any idea?

Thanks

[steveboyson]

yum, zypper or dpkg updates came along? Just an idea ...

[Pizzicato]

Thanks for the hint!
I'm using Scientific Linux 6, by the way. It's based in RHEL6, and it comes by default with yum autoupdate enabled, but I disabled it some time ago. Is there any other autoupdate that I might be skipping?

Also, yum.log does not show any sshd updates...

Does anybody know what is the algorithm that Zabbix uses for checksums?

I'm going to keep a file with the md5 chechsums of /usb/sbin/sshd, to check it myself each time I get that alert. We'll see if it clears anything.

What's really strange is that I get the alert at the similar times, 3:58, 9:18, 10:38, alway ending in 8 ¿?¿?

Cheers!

[jolibee]

I've got a similar problem recently. Zabbix reports that /usr/bin/passwd has been changed. According to zabbix docs, zabbix uses unix cmd cksum to calculate the checksum of a file.
stat shows that the change time of /usr/bin/passwd has been changed,but the content remains unchanged.
The problem seems to be caused by prelink. You can check the original cksum of some file by issue the followling command:
prelink -y /usr/bin/passwd | cksum, and then to compare with some other host's checksum.

FYI:

https://access.redhat.com/solutions/75013

Thanks for the hint!
I'm using Scientific Linux 6, by the way. It's based in RHEL6, and it comes by default with yum autoupdate enabled, but I disabled it some time ago. Is there any other autoupdate that I might be skipping?

Also, yum.log does not show any sshd updates...

Does anybody know what is the algorithm that Zabbix uses for checksums?

I'm going to keep a file with the md5 chechsums of /usb/sbin/sshd, to check it myself each time I get that alert. We'll see if it clears anything.

What's really strange is that I get the alert at the similar times, 3:58, 9:18, 10:38, alway ending in 8 ¿?¿?

Cheers!