>From 1cd7ab08f3881e51f6553008f935c231903c1168 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 23 Aug 2012 17:56:38 -0400 Subject: [PATCH 5/7] Updated Software Integrity prose General language changes for readability and tone consistency --- RHEL6/input/system/software/integrity.xml | 54 +++++++++++++--------------- 1 files changed, 25 insertions(+), 29 deletions(-) diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml index 1729764..c31087d 100644 --- a/RHEL6/input/system/software/integrity.xml +++ b/RHEL6/input/system/software/integrity.xml @@ -4,29 +4,25 @@ Both the AIDE (Advanced Intrusion Detection Environment) software and the RPM package management system provide mechanisms for verifying the integrity of installed software. -AIDE is designed to be a replacement for the well-known -Tripwire integrity checker. The RPM package management system can -conduct integrity checks by comparing information in its -metadata database with files installed on the system. +AIDE is the successor to the well-known Tripwire integrity +checker. The RPM package management system can conduct integrity +checks by comparing information in its metadata database with +files installed on the system.

-Integrity checking cannot -prevent intrusions into your system, but can detect that -they have occurred. Requirements for software integrity checking may be -highly dependent on the environment -in which the system will be used. +Integrity checking cannot prevent intrusions into your +system, but can detect that they have occurred. Requirements +for software integrity checking may be highly dependent on +the environment in which the system will be used. Verify Integrity with AIDE AIDE conducts integrity checks by comparing information -about files with previously-gathered information, which it stores in a -database (to use the term loosely; it's really just data inside a file). -Ideally, the AIDE database would be built before the -system is connected to any network, though this may prove -impractical due to registration and software updates. -AIDE is highly configurable. This advice is based on information -provided in its documentation available in -/usr/share/doc/aide-VERSION +about files with previously-gathered information. Ideally, the AIDE +database should be created immediately after your system is built, +and before the system is connected to any network. AIDE is highly +configurable, with further configuration information located in +/usr/share/doc/aide-VERSION @@ -50,9 +46,8 @@ The prelinking feature changes binaries in an attempt to decrease their startup time. In order to disable it, change or add the following line inside the file /etc/sysconfig/prelink:
PRELINKING=no
-Next, run the command +Next, the following command to return binaries to a normal, non-prelinked state:
# /usr/sbin/prelink -ua
-to restore binaries to a normal, non-prelinked state. The prelinking feature can interfere with the operation @@ -141,10 +136,11 @@ See the man page for rpm to see a complete explanation of each column. Verify File Permissions with RPM -The RPM package management system can check the permissions of -thousands of installed files, including many that are important to system -security. The following command will list which files on the system have -permissions that are different from what is expected by the RPM database: +The RPM package management system can check file access +permissions of installed software packages, including many that are +important to system security. The following command will list which +files on the system have permissions that are different from what +is expected by the RPM database:
# rpm -Va | grep '^.M'
@@ -159,13 +155,13 @@ this baseline should be investigated. Verify File Hashes with RPM -The RPM package management system -can check the hashes of thousands of installed files, including -many that are important to system security. -To list which files on the system have hashes that differ from what is expected by the -RPM database (except for configuration files, which may be expected to change): +The RPM package management system can check the hashes of +installed software packages, including many that are important to system +security. Run the following command to list which files on the system +have hashes that differ from what is expected by the RPM database:
# rpm -Va | grep '^..5'
-A ā€œcā€ in the second column indicates that a file is a configuration file. +A ā€œcā€ in the second column indicates that a file is a configuration file, +which may appropriately be expected to change.
The MD5 hash on important files like system executables should match the information given -- 1.7.1