From owner-freebsd-security@FreeBSD.ORG Wed Aug 18 14:54:14 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D216216A4CE for ; Wed, 18 Aug 2004 14:54:14 +0000 (GMT) Received: from rosebud.otenet.gr (rosebud.otenet.gr [195.170.0.26]) by mx1.FreeBSD.org (Postfix) with ESMTP id 414AF43D46 for ; Wed, 18 Aug 2004 14:54:11 +0000 (GMT) (envelope-from keramida@linux.gr) Received: from orion.daedalusnetworks.priv (aris.bedc.ondsl.gr [62.103.39.226])i7IEs7S3012636; Wed, 18 Aug 2004 17:54:07 +0300 Received: from orion.daedalusnetworks.priv (orion [127.0.0.1]) i7IEs1tY008998; Wed, 18 Aug 2004 17:54:01 +0300 (EEST) (envelope-from keramida@linux.gr) Received: (from keramida@localhost)i7IEs1L4008997; Wed, 18 Aug 2004 17:54:01 +0300 (EEST) (envelope-from keramida@linux.gr) Date: Wed, 18 Aug 2004 17:54:00 +0300 From: Giorgos Keramidas To: "Thordur Ivar B." Message-ID: <20040818145400.GF7263@orion.daedalusnetworks.priv> References: <20040818121102.95460.qmail@web52402.mail.yahoo.com> <20040818142511.390043af.thib@mi.is> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040818142511.390043af.thib@mi.is> cc: freebsd-security@freebsd.org Subject: Re: chfn, date, chsh INFECTED according to chkrootkit X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Aug 2004 14:54:14 -0000 On 2004-08-18 14:25, "Thordur Ivar B." wrote: > But still, you can only be sure if you trust you CVS checkout. > I have found it rather annyoing not have'ing checksums of each and > every file in /usr/src. And having a "secure" (man-in-the-middle > attack, etc comes in mind) way of optaining the checksum file.( A good > shell script could verify the checkout and you could sleep easy ;) > > Do correct me about the checksums if I'm wrong. Would something like this work for you? # mount /mnt/floppy # mtree -c -K cksum,flags -p . | \ bzip2 -9c - > /mnt/floppy/src.dist.bz2 # umount /mnt/floppy Then you can mount the floppy disk and check the /usr/src tree against the checksums saved by mtree with: # mount /mnt/floppy # bunzip2 -cd /mnt/floppy/src.dist.bz2 | \ mtree -u -f - # umount /mnt/floppy Any differences of the files since your last CVSup should be easy to catch with this little trick. I've just tested this on my -CURRENT installation and the bzip2'd spec file generated by the first mtree invocation is a little less than 600 KB for /usr/src. It fits nicely in a single floppy disk :-)