Currently to verify package integrity, the command rpm --verify is run. In reading the rpm manual (http://ftp.rpm.org/max-rpm/s1-rpm-verify-output.html), there is no indication as to the veracity of the verification process.

It is my understanding solutions such as AIDE and Tripwire expect a known good state and are unable to attest integrity when packages have been updated and/or upgraded.

  • What alternatives are there to assure the integrity of packages post installation as well as subsequent updates and upgrades?
  • How can corruptions by omission or commission be detected and identified?
  • What options are there if a known good state is unknown?

In my experience, rpm --verify is accurate enough for a first pass. I have not tried to remove a file and see if rpm --verify catches it. It does identify files that have changed.
rpm --verify is only ONE of the tools I use. I also use an intrusion detection system (AIDE) to identify files that have been added, removed or modified.
If there are specific files that I want to ensure their integrity, I use Puppet to control them. In short, Puppet uses a checksum to verify the integrity of the file. If it does not match, it can either send an alert, or replace the file with a correct version.

| improve this answer | |

Perhaps you're looking for rpm --checksig which verifies the signature of the rpm.

According to http://ftp.rpm.org/max-rpm/ch-rpm-verify.html, rpm --verify verifies the following attributes of the rpm:

Owner, Group, Mode, MD5 Checksum, Size, Major Number, Minor Number, Symbolic Link String, Modification Time

The checksum can tell you if the rpm is corrupt but a rpm from a nefarious source can be integral as far as its checksum is concerned. Verifying the rpm's signature with a trusted PGP key ensures the rpm is trusted. See http://ftp.rpm.org/max-rpm/ch-rpm-checksig.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.