0

Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked about the legitimacy of that warning in this separate question:

What sort of steps can we take to definitively verify that a given rkhunter report is a false positive?

I strongly suspect it is a false positive, but I had a further question that this prompted me to think about, more generally speaking.

How confident can somebody be that mainstream yum repositories (such as this, or for example, the rhel-7-server-rpms) will be free of malware? Is my confidence misplaced? Do they go through a vetting and screening process strong enough that an administrator can feel comfortable running yum update freely?

|improve this question
  • What does rpm -qf say about the file? It will tell you which RPM it belongs to and from there you can track exactly where you downloaded it from. It may as well have nothing to do with your yum update. – grochmal Dec 26 '16 at 0:26
2

From this link Redhat suggests:

  1. Red Hat does provide a high level of security in the operating system and packages that they distribute. As security issues are discovered in various applications (and presumably in packages), Red Hat provides updated packages in a way which keeps potential risk to a minimum;
  2. Red Hat Enterprise Linux 3 and higher employs ExecShield to eliminate the possibility of Buffer-Overflows (so greatly reducing the possibility of many exploits);
  3. Redhat's own network, systems and packages are kept updated with all patches and security updates;
  4. Redhat's own systems have Security-enhanced Linux (SELinux) enabled; and
  5. A friend I know who is a Kernel developer for Redhat tells me realtime filesystem scanning is also used on Redhat's own systems in addition to the above, as well as 3rd party Linux antivirus.

So, to answer: Although there is no such thing as guaranteed perfect security, Redhat (meaning the owners of the rhel-7-server-rpms (and related repo)) appears to be doing due-diligence (risk management) sufficient to give you a reasonable degree of confidence. Your confidence isn't misplaced.

That said, I'm talking about the rhel-7-server-rpms repo, and not some non-Redhat repo.

|improve this answer
  • 1
    I think this is a very good overall overview both of why we can be confident in the Red Hat repositories. Of course, as you allude to in the last line, we have to be as cautious about non-Red Hat repositories as we would, for example, installing 3rd party software on any machine (we can be as confident in them as we are in the company). – SCruz Dec 29 '16 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.