On Wed, Dec 23, 1998 at 02:45:07AM -0000, D. J. Bernstein wrote:
> Peter C. Norton writes:
> > As to why I'd rather not have to recreate the files - if I'm following
> > a break-in, I have more useful things to do, like find the schmuck who
> > did it. Being able to verify binaries on a large number of systems
> > helps me do that.
>
> So what do you do about /etc/aliases.db? Why can't you do the same thing
> with the qmail files?
I would not need a compiler and associated tools to rebuild
/etc/aliases.db. I may instead create an rpm for myself that has the
/etc/aliases.db that I use for a site and compare that as well. For
sites with sendmail, it's not a bad idea. So why isn't qmail flexible
enough to let me do the same thing for its files?
> I get the impression that, in fact, you don't verify /etc/aliases.db,
> and that you're relying on security through obscurity. That's dangerous.
> Promoting such behavior is irresponsible.
Throwing out buzzwords like security through obscurity and vaporware
(I've definetely got the script I mentioned to read /etc/aliases.db,
but you didn't ask) doesn't mean anything at this point. How am I
promoting such behavior? You're spouting BS.
> > Don't you want to know how you're being attacked?
>
> How the initial intrusion happened, yes, so that I can explain how to
> fix the hole. But there's no hole involved in setting up a trojan horse
> once you already have root.
You do it your way. I'd like to have that information.
> > But it's not possible to do this across multiple systems that have
> > different uid's.
>
> Wrong. All the necessary tools are included in a var-qmail package. Go
> read http://pobox.com/~djb/qmail/var-qmail.html.
The var-qmail system isn't flexibly enough to work with, extend, or
augment my packaging tools, which do accomodate everything else I've
packaged. It still doesn't even give me a guarantee that I can
compare 2 binaries on 2 systems. I don't like it.
BTW, the following:
"Of course, these aren't problems for an operating system that
includes qmail as the default MTA."
is pretty funny.
-Peter
