<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: AIDE/Tripwire</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Actually it would probably be a good idea to rework the database a little bit so you can have "Version Control" embedded into it. The version control would log who installed the RPM (if using sudo to install), when the package was installed and it's old information. </FONT></P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Mr. Adam ALLEN [<A HREF="mailto:adam@dynamicinteraction.co.uk">mailto:adam@dynamicinteraction.co.uk</A>] </FONT>
<BR><FONT SIZE=2>Sent: Wednesday, August 13, 2003 9:12 AM</FONT>
<BR><FONT SIZE=2>To: rhl-beta-list@redhat.com</FONT>
<BR><FONT SIZE=2>Subject: Re: AIDE/Tripwire</FONT>
</P>
<BR>
<P><FONT SIZE=2>On Wed, 2003-08-13 at 13:13, Leonard den Ottolander wrote:</FONT>
<BR><FONT SIZE=2>> Hi Tommy,</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> > Maybe just setup a magic policy directory (ala /etc/tripwire.d ) .. </FONT>
<BR><FONT SIZE=2>> > that each RPM can drop its "specs" into and have the policy </FONT>
<BR><FONT SIZE=2>> > generated automatically or something..</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2> </FONT>
<BR><FONT SIZE=2>I think it's dangerous to automatically rebuild the database, but something like: </FONT>
</P>
<P><FONT SIZE=2> - get the rpm to dump into /etc/tripwire.d</FONT>
<BR><FONT SIZE=2> - alert the user that they should run something like (or aide)</FONT>
<BR> <FONT SIZE=2>tripwire --rebuild --parse-specs</FONT>
<BR><FONT SIZE=2> - it would probably be a safe idea to have RH sign the spec file, with the same key used to sign the RPM, and the only process files out of /etc/tripwire.d which can have their digital signatures verified. Users might trust the /etc/tripwire.d contents too much- which is why I think this step might be necessary.</FONT></P>
<P><FONT SIZE=2>Need to be really careful that my rpm doesn't drop in a new /etc/passwd. Since the specfile would list /etc/passwd as a file- would this instruct tripwire to re-calculate the checksums on /etc/passwd. (Which may have all the accounts deleted).</FONT></P>
<P><FONT SIZE=2>Just a quick not-really thought through pitfalls that might exist.</FONT>
</P>
<BR>
<P><FONT SIZE=2>-- </FONT>
<BR><FONT SIZE=2>Regards,</FONT>
<BR><FONT SIZE=2>Adam Allen.</FONT>
</P>
<P><FONT SIZE=2>adam@dynamicinteraction.co.uk</FONT>
<BR><FONT SIZE=2>pgp <A HREF="http://search.keyserver.net:11371/pks/lookup?op=vindex&search=adam%40dynamicinteraction.co.uk" TARGET="_blank">http://search.keyserver.net:11371/pks/lookup?op=vindex&search=adam%40dynamicinteraction.co.uk</A></FONT>
</P>
</BODY>
</HTML>