1

Currently to verify package integrity, the command rpm --verify is run. In reading the rpm manual (http://ftp.rpm.org/max-rpm/s1-rpm-verify-output.html), there is no indication as to the veracity of the verification process.

It is my understanding solutions such as AIDE and Tripwire expect a known good state and are unable to attest integrity when packages have been updated and/or upgraded.

  • What alternatives are there to assure the integrity of packages post installation as well as subsequent updates and upgrades?
  • How can corruptions by omission or commission be detected and identified?
  • What options are there if a known good state is unknown?

2 Answers 2

2

In my experience, rpm --verify is accurate enough for a first pass. I have not tried to remove a file and see if rpm --verify catches it. It does identify files that have changed.
rpm --verify is only ONE of the tools I use. I also use an intrusion detection system (AIDE) to identify files that have been added, removed or modified.
If there are specific files that I want to ensure their integrity, I use Puppet to control them. In short, Puppet uses a checksum to verify the integrity of the file. If it does not match, it can either send an alert, or replace the file with a correct version.

1

Perhaps you're looking for rpm --checksig which verifies the signature of the rpm.

According to http://ftp.rpm.org/max-rpm/ch-rpm-verify.html, rpm --verify verifies the following attributes of the rpm:

Owner, Group, Mode, MD5 Checksum, Size, Major Number, Minor Number, Symbolic Link String, Modification Time

The checksum can tell you if the rpm is corrupt but a rpm from a nefarious source can be integral as far as its checksum is concerned. Verifying the rpm's signature with a trusted PGP key ensures the rpm is trusted. See http://ftp.rpm.org/max-rpm/ch-rpm-checksig.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .