This is a RedHat Enterprise 5.5 system. I ran a verification check against an RPM, and it looks like two files have changed:
# rpm --verify shadow-utils S.5....T c /etc/default/useradd S.5....T c /etc/login.defs
I have access to the RPM which originally installed these files. Can diff these changed files against the version which is stored in the RPM?