Re: System integrity verification and other delusions

[D. J. Bernstein]

Russell Nelson writes:
> Users commonly recompile /etc/alises.db.

So what? A trojaned /etc/aliases.db has an excellent chance of sticking
around long enough for an intruder to break in again.

If you have a method of guaranteeing a clean /etc/aliases.db after a
breakin, why can't you use the same method for the qmail files?

Your suggestion, apparently, is to reinstall /etc/aliases.db. Why don't
you think that exactly the same solution works for a var-qmail RPM?

> If Redhat requires it's binaries to be unmodified for security reasons,

It doesn't. /etc/aliases.db is a binary, modified on most systems.
What's wrong with handling the qmail files the same way?

---Dan