AIDE problem handling symlinks
AIDE (Advanced Intrusion Detection Environment) is a
tool that creates a Database that can be used to
verify the integrity of files.
As modern filesystems (ext2, ufs, etc) implement fast
symlinks to store target's pathname, if only checksums
options (sha1, md5, tiger, etc) are used to check the
integrity of a soft link file, AIDE will not be able
to detect changes made on it.
If you use a mtime/ctime option, and somebody change a
target's pathname, AIDE will show it, but these
options are easy trickly with a standard Unix "touch"
command (and root privilege, of course).
So, I added the new option "l" to AIDE, to implement a
target's pathname comparison for symbolic links
against the database. If a target's pathname is
changed on a symlink file, the difference will be
showed.
Please upgrade your AIDE tool to the last version
available (>= 0.13-r1)
__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis!
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar