1

Currently to verify package integrity, the command rpm --verify is run. In reading the rpm manual (http://ftp.rpm.org/max-rpm/s1-rpm-verify-output.html), there is no indication as to the veracity of the verification process.

It is my understanding solutions such as AIDE and Tripwire expect a known good state and are unable to attest integrity when packages have been updated and/or upgraded.

  • What alternatives are there to assure the integrity of packages post installation as well as subsequent updates and upgrades?
  • How can corruptions by omission or commission be detected and identified?
  • What options are there if a known good state is unknown?
2

In my experience, rpm --verify is accurate enough for a first pass. I have not tried to remove a file and see if rpm --verify catches it. It does identify files that have changed.
rpm --verify is only ONE of the tools I use. I also use an intrusion detection system (AIDE) to identify files that have been added, removed or modified.
If there are specific files that I want to ensure their integrity, I use Puppet to control them. In short, Puppet uses a checksum to verify the integrity of the file. If it does not match, it can either send an alert, or replace the file with a correct version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.