Re: securing a unix system - suggestions on checking for intrusions
Robin Paulson <[email protected]>
| Newsgroups | gmane.org.user-groups.linux.new-zealand.general |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 6 Oct 2011 12:30:27 +1300, Nick Rout wrote: > On Thu, Oct 6, 2011 at 10:22 AM, Robin Paulson > <[email protected]> wrote: >> this was posted on /. earlier, in the wake of the kernel.org >> intrusion last >> month. >> >> http://article.gmane.org/gmane.linux.kernel/1197924 >> >> it shows some interesting capabilities rpm has which deb doesn't > > I didn't see them, there was just a more laborious checking script > for > debs as opposed to the built in option for rpms "3. Verify that your packages are really signed with the distro's keys. Here's a bash snippet that can do this on a rpm based system to verify that the packages are signed with any key, not necessarily your distro's key. That exercise is left for the reader: for package in `rpm -qa`; do sig=`rpm -q --qf '%{SIGPGP:pgpsig}\n' $package` if [ -z "$sig" ] ; then # check if there is a GPG key, not a PGP one sig=`rpm -q --qf '%{SIGGPG:pgpsig}\n' $package` if [ -z "$sig" ] ; then echo "$package does not have a signature!!!" fi fi done Unfortunately there is no known way of verifying this on Debian-based systems." ok, plural was wrong -- robin http://bumblepuppy.org/blog/?p=237 - government bill to remove basic human rights in NZ _______________________________________________ NZLUG mailing list [email protected] http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug