Heya, * Adrian 'Dagurashibanipal' von Bidder <avbidder@fortytwo.ch> [20040503 09:20]: > On Friday 30 April 2004 15.25, Andreas Kotes wrote: > > What do you think? Signed binaries instead of tools like tripwire or > > aide et all? > > Solutions like tripwire and aide, or the forthcoming (when???) solution > of signing binary packages (together with the package containing > md5sums of all non-modifiable files) have the advantage of also > covering data files. > > In other words: why put in an infrastructure covering executables only > when you need a solution to verify data files anyway (I think corrupted > data files may be equally bad as corrupted program files, as the > contents of a data file may influence the behaviour of a program > greatly. Think embedded scheme/perl/... snippets etc. etc.) I agree on that - maybe 'replacing tripwire' was the wrong phrasing. A filesystem with runtime-checksums or all files might be nice, or something which identifies files, too .. i.e.: - file1 has checksum1/size1 - file2 has checksum2/size2 - file3 is an archive (tgz,deb,rpm,zip,whatever) containing file1+file2 plus this and that metadata, resulting in checksum3/size3 - file4 is a directory containing file1+file2+file3, with permissions and ownership this and that, resulting in checksum4/size4 - .... - fileX is a root filesystem containing directories/files fileY-fileZ with the following metadata: etc .. .. with the possibility of full recursion, and optional signatures for each list with checksums. the 'topmost' checksum could be saved on a disk/usb-stick, or simply written on a piece of paper. integrity checks might be done the same way .. an added benefit would be the possibility to identify files, i.e. checksum2/size2 -> file2, contained in file3 .. great for cleaning old systems. or somethink like checksumF/sizeF -> file1, infected with virus X (whoops ..) hm. thinking of that, ELF signing might help for only part of the system. nonetheless, having /sbin/init, the interpreters, basic system utilities (fbset, fdisk, e2fsck) verifyable without having to run a full-blown file modification system might be desirable .. Kind regards, Count -- Andreas Kotes - ICQ: 3741366 - The views expressed herein are (only) mine! Follow the path of the unsafe, independent thinker. Expose your ideas to the danger of controversy. Speak your mind and fear less the label of "crackpot" than the stigma of conformity. (Thomas J. Watson) ### OpenPGP key 0x8F94C228
Attachment:
signature.asc
Description: Digital signature