System integrity verification and other delusions

[D. J. Bernstein]

Sam writes:
> In a sitution like this, you just *don't* ship a binary package that,
> after it's installed, it scribbles all over its binary files.

sendmail's /etc/aliases.db is a security-critical binary file created
from user-supplied configuration data.

How, pray tell, are you going to check the integrity of /etc/aliases.db?
If you can verify /etc/aliases.db, why can't you verify the qmail files?

The reality is that people don't verify /etc/aliases.db after a breakin.
They either ignore it, leaving a perfectly adequate hiding place for
intruders, or reinstall it, which is the right thing to do.

---Dan