Can anyone explain this odd behavior on my RHEL 4 boxes? Am I
misunderstanding something?

# md5sum /usr/lib/libncurses.so.5.4
2c83fcdab8bd5ef7662fd7f7dea2db79 /usr/lib/libncurses.so.5.4


# ls -ltar /usr/lib/libncurses.so.5.4
-rwxr-xr-x 1 root root 879961 Aug 31 2004 /usr/lib/libncurses.so.5.4


#rpm -q --dump ncurses | grep libncurses.so.5.4
/usr/lib/libncurses.so.5.4 878185 1093990722
e7722a32494d30bcdcc7832bd3bd9a4f 0100755 root root 0 0 0 X


>From RHN site:

/usr/lib/libncurses.so.5.4 e7722a32494d30bcdcc7832bd3bd9a4f
2004-08-31 22:18:42 878,185 bytes


# rpm -V ncurses



This says to me that this lib file has a different checksum and file
size than what RHN as well as the RPM database says it should be.
However, when I try to verify, it comes back clean.

It's not just this file. I had to reinstall the glibc rpm in order to
fix a problem with Oracle starting up, so there's definitely some kind
of funky file difference. My first thought was rootkit, but having
those attack libraries seems rather odd and it seems to be almost
every library I check, including ones that I can't see any benefit for
attacking.

On a related note, anyone know if there's a way to reinstall all RPMs
without having to download everything?

Thanks in advance,

Hugh