Re: [Rkhunter-users] Updating hash database (script)
Brought to you by:
dogsbody
From: John H. <joh...@pl...> - 2006-04-15 19:20:43
|
On Wed, 2006-03-29 at 21:48 +0200, unspawn wrote: > > Since disabling hash check in RKH aint good and I see people complaining > about this regularly I thought I'd throw in a wee helper app until there's > a better solution (couldn't find anything like this, if it *is* there > just tell me OK). > Hello, The script is a good idea, and I'll produce a diff patch for some of the problems I've found with it. However, I've been thinking more about the actual problem of keeping machines up todate. As soon as the os.dat file is released again I would need to run the script again. Would it not be better if the script produced 2 different files, for example, os.dat.local and defaulthashes.local, which contain just the data for the local host. Also, if the script is run again the files would just be overwritten; the os id number (field 1) could be set to -1 so as to avoid the need to generate a unique id that isn't used in the os.dat file. The main rkhunter program would also need to be modified. It would run as normal using the os.dat/defaulthashes files, but if no records could be found for the local host then the '.local' files would be looked at. If they don't exist, have no data or can't be read, then rkhunter can just ignore them. It would then produce the usual 'unsupported O/S' error message and the sysadmin can sort out the problem. Taking this even further though, I started to wonder why do we need an os.dat file? The only data I am interested in are the hashes of my local host and I should be able to produce those automatically from the script. All the other data in the os.dat file is irrelevant for my host. To that extent would it not be better to scrap the os.dat and defaulthashes files altogether? The rkhunter '--update' option is still required for the other data files though. So to use rkhunter all that is required is to install the software (which has no os.dat/defaulthashes files); run the script to create the os.dat/defaulthashes files for the local host; then run rkhunter. The script then only needs to be run when the local host changes. There is no need to register new Linux versions or distributions, and the '--update' option is still required but only for the other data files. Regards, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: Joh...@pl... Fax: +44 (0)1752 233839 |