Re: Certifying a RedHat Install

> Yeah you can an rpm -Va, but who the hell installs a root =
> kit, backdoor, etc via an rpm?

Actually, in the case of a naive/stupid attacker, an rpm -Va will catch them 
as it will detect that a binary such as /bin/ls doesn't match the one 
installed from that rpm. Putting aside for the moment the fact that most any 
attacker (even script kiddies) will use a rootkit that will return the proper 
checksum, this brings up an interesting attack scenero: if the attacker does 
install their new tools via an rpm, the rpm -Va will NOT catch it, because 
now the files match the package they're installed from!

The important thing to keep in mind here is that rpm's verify functionality 
was designed to detect random or accidental corruption or deletion of files, 
not malicious activity.

Terry
#include <stdDisclaimer.hh>