Re: securing a unix system - suggestions on checking for intrusions
Andrew Simpson <[email protected]>
| Newsgroups | gmane.org.user-groups.linux.new-zealand.general |
|---|---|
| Message-ID | <20111006181754.16ed3cb9@orion> |
On Thu, 06 Oct 2011 12:30:27 +1300 Nick Rout <[email protected]> wrote: > On Thu, Oct 6, 2011 at 10:22 AM, Robin Paulson > <[email protected]> wrote: > > this was posted on /. earlier, in the wake of the kernel.org > > intrusion last month. > > > > http://article.gmane.org/gmane.linux.kernel/1197924 > > > > it shows some interesting capabilities rpm has which deb doesn't > > I didn't see them, there was just a more laborious checking script for > debs as opposed to the built in option for rpms Actually the command 'rpm --verify --all', which is at the top of the article, does much, much more than apt can do in verifying packages. [1] The rpm keeps a database of md5sum, permissions, size, date, etc on each installed file and each package. Hence this can very useful in checking what's changed in a system - providing you can trust the database.[2] I've used this when I used Redhat 5, 6, 7, 8 & 9. It does tend to spit out a lot of false positives - config files that are manually changed, files in /dev, etc. Since changing to apt based distributions, I've found no equivalent. I guess you would have to install something like Tripwire. Andrew [1] http://www.rpm.org/max-rpm/ch-rpm-verify.html [2] http://www.sans.org/security-resources/idfaq/rpm.php _______________________________________________ NZLUG mailing list [email protected] http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug