<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII"> <META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12"> <TITLE>RE: AIDE/Tripwire</TITLE> </HEAD> <BODY> Actually it would probably be a good idea to rework the database a little bit so you can have "Version Control" embedded into it. The version control would log who installed the RPM (if using sudo to install), when the package was installed and it's old information. -----Original Message----- From: Mr. Adam ALLEN [<A HREF="mailto:adam@dynamicinteraction.co.uk">mailto:adam@dynamicinteraction.co.uk</A>] Sent: Wednesday, August 13, 2003 9:12 AM To: rhl-beta-list@redhat.com Subject: Re: AIDE/Tripwire On Wed, 2003-08-13 at 13:13, Leonard den Ottolander wrote: > Hi Tommy, > > > Maybe just setup a magic policy directory (ala /etc/tripwire.d ) .. > > that each RPM can drop its "specs" into and have the policy > > generated automatically or something.. > I think it's dangerous to automatically rebuild the database, but something like: - get the rpm to dump into /etc/tripwire.d - alert the user that they should run something like (or aide) tripwire --rebuild --parse-specs - it would probably be a safe idea to have RH sign the spec file, with the same key used to sign the RPM, and the only process files out of /etc/tripwire.d which can have their digital signatures verified. Users might trust the /etc/tripwire.d contents too much- which is why I think this step might be necessary. Need to be really careful that my rpm doesn't drop in a new /etc/passwd. Since the specfile would list /etc/passwd as a file- would this instruct tripwire to re-calculate the checksums on /etc/passwd. (Which may have all the accounts deleted). Just a quick not-really thought through pitfalls that might exist. -- Regards, Adam Allen. adam@dynamicinteraction.co.uk pgp <A HREF="http://search.keyserver.net:11371/pks/lookup?op=vindex&search=adam%40dynamicinteraction.co.uk" TARGET="_blank">http://search.keyserver.net:11371/pks/lookup?op=vindex&search=adam%40dynamicinteraction.co.uk</A> </BODY> </HTML>