During a security audit, an administrator runs 'rpm -V openssh-server' and receives the output '..5....T. c /etc/ssh/sshd_config'. What does the '5' character in that output specifically indicate?
- AThe file's MD5 checksum differs from the original package
- BThe file's group ownership has changed
- CThe file's SELinux context has changed
- DThe file's permission bits have changed
Show answer & explanationAnswer & explanation
Correct answer: A. The file's MD5 checksum differs from the original package
In rpm -V output, each character position reports a specific attribute check; the '5' position represents the MD5 (or digest) checksum, and a '5' shown means the file's content checksum no longer matches the value recorded in the RPM package database, indicating the file was modified. Permission changes are indicated by 'M', group by 'G', and SELinux context by a separate letter (context) not '5'.
Why the other options are wrong
- B. Group ownership changes are represented by 'G', not '5'.
- C. SELinux context differences appear at a different position (labeled context, often shown separately), not the '5' digest field.
- D. Permission bit changes are represented by 'M' (mode), a different field than '5'.
rpm -V Verification Codes
rpm -V compares installed files against the RPM database, printing a code string where each position flags a specific attribute mismatch (size, mode, checksum, etc.); a dot means no change.
- S = size differs
- M = mode (permissions) differs
- 5 = MD5/digest checksum differs (content changed)
- U/G = user/group ownership differs
- T = mtime (modification time) differs
Memory trick: '5' looks like a fingerprint scanner — it's checking the file's digital fingerprint (checksum).