Re: System integrity verification and other delusions

[D. J. Bernstein]

Peter C. Norton writes:
> /etc/aliases.db however is a dynamic file.  However verifying it can
> be easily done by a human with fairly standard interperters like perl,
> or python, or with a small c program.  In fact, these programs could
> easily parse for the tokens that indicate danger.

And what exactly is the advantage of this vaporware, compared to the
obvious solution---namely, recreating /etc/aliases.db?

> Can I do this with qmail's binaries?

With a var-qmail package, yes, of course you could write a program to
verify the bin/* integrity. In fact, it would be a simple shell script.
See qmail-1.03/BIN.Makefile. But it's even easier to recreate the files.

> > If you can verify /etc/aliases.db, why can't you verify the qmail files?
> The qmail binaries are static after installation.  

Explain. Why would it be _harder_ to verify static files?

(Of course, /etc/aliases.db might be static too. Depends on the host.)

---Dan