Re: System integrity verification and other delusions

[D. J. Bernstein]

Sam writes:
> If you have modified aliases yourself, well, you better tuck away a known
> good copy somewhere else, and compare against that.

Gee. What happened to RPM verification? A moment ago I thought you were
talking about RPM verification as some sort of anti-trojan guarantee.
Why doesn't it work for /etc/aliases.db?

If you're willing to ``tuck away a known good copy'' of /etc/aliases.db
and hundreds of other system-dependent security-critical files, why
can't you include the qmail files in the list?

> Then, install a known verified package, including a fresh /etc/aliases.db.
> Then, reapply your local configuration changes, by hand.

Why can't you do exactly the same thing for qmail?

---Dan