--- RHEL6/input/system/software/integrity.xml | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 44bb1b2..14730e2 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -174,7 +174,15 @@ have hashes that differ from what is expected by the RPM database: <pre># rpm -Va | grep '^..5'</pre> A "c" in the second column indicates that a file is a configuration file, which may appropriately be expected to change. +If the file that has changed was not expected to then refresh from distribution media or online repositories. +<pre>rpm -Uvh <i>affected_package</i></pre> +OR +<pre>yum reinstall <i>affected_package</i></pre> </description> +<ocil clause="there is output"> The following command will list which files on the system +have file hashes different from what is expected by the RPM database. +<pre># rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'</pre> +</ocil> <rationale> The hash on important files like system executables should match the information given by the RPM database. Executables with erroneous hashes could be a sign of nefarious activity -- 1.8.0 _______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
