Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I know about rpm's -V option that tells me if files installed via RPMs have not been modified, but is there a simple way to get rpm to tell me if any files in a given directory were not installed by RPM? I figure I can use --whatprovides on each file, but is there a faster way?

share|improve this question
2  
This would be especially difficult in a directory that might have files from dozens of packages like /etc. You are better off not trying to use RPM in this way. What is your aversion to tripwire? Would it be easier if the package were included? Look into AIDE. – Aaron Copley Jun 17 '11 at 20:30
1  
Gotta say, that's trying to shoehorn the wrong tool into the job. – John Gardeniers Jun 17 '11 at 23:12

2 Answers

up vote 3 down vote

Regardless of the feasibility of this I don't think it would be a good idea. The reason is that anyone who could modify a critical file (presumably only writeable by root) could alter the RPM database as well.

share|improve this answer
What SvenW says is true. While in practice I have never seen an attacker attempt to modify the local rpm database, this is a very real problem and the reason that systems like tripwire allow for off-host storage of checksums: in the event of a system compromise you can't trust any data stored on the system. – larsks Jun 17 '11 at 20:16
1  
The RPM database stores information about installed packages. You can query a known good / clean RPM stored elsewhere to list the files it provides. The problem with this is attacking the problem in reverse. You'd have to enumerate all of the installed packages and list the files of each, then diff the file system. What a nightmare of a process. – Aaron Copley Jun 17 '11 at 20:32
up vote 4 down vote

why not use the opensource tripwire?

http://sourceforge.net/projects/tripwire/

share|improve this answer
1  
Because all of my experiences with tripwire have been bad and this isn't for intrusion detection, it is for detecting changes made in a production environment. – Chas. Owens Jun 19 '11 at 0:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.