> -----Original Message-----
> From: Jonathan Hutchins
>
> ... I did a CRC check against ALL of the system files. They're
> fine. I checked
> RPM before I used it to check the rest of the system.
>
> RPM's a great tool for a lot of things, including verifying
> system integrity. ...
>
> It's VERY hard to hack an RPM system in such a way as to
> conceal tampering
> with files within the packages. Not impossible, but hard in
> a way that the
> low-level simplicity of rootedoor tends to contraindicate.
>
On this note, other than CRC checking and MD5 checksum options,
is there any kind of an equivalent with Debian for this type of
check? I'm guessing no. Although, it might be possible to build
an rpm database of installed software on a Debian box and then
use that as an additional check. Of course there's nothing, stopping
a cunning cracker from building an RPM database, setting the timestamp
and copying it onto the cracked system. Something possible with Jonathon's
box too. Jonathon, was your check done with a local copy of the RPM database,
or an archived known good copy? Certainly, if I were a cracker, installing
a new copy of the RPM database would be part of my initial and every subsequent
loading of software onto a cracked system. After all, to be successful at cracking it best to remain undetected.
Brian