rootkit?

[James Wilkinson]

Michael A. Peters wrote:
> Sun use to (still does?) allow you to enter an md5sum and it would tell
> you exactly what file it matched, along with what patch level.

Ralf Corsepius replied:
> rpm based systems have "rpm {-V|--verify}", which provide a comparable
> feature.

Unfortunately, this is pretty useless if you can't trust the RPM
database.

And on a compromised machine, you can't trust the RPM database.

And, unfortunately, prelinking means that you can't even compare them to
a "known good" machine.

James.

-- 
E-mail address: james | "We completely deny the allegations, and we're
@westexe.demon.co.uk  | trying to identify the alligators."