Home page logo

bugtraq logo Bugtraq mailing list archives

AIDE problem handling symlinks
From: fryxar fryxar <fryxar () yahoo com ar>
Date: Mon, 27 Nov 2006 15:42:53 +0000 (GMT)

AIDE (Advanced Intrusion Detection Environment) is a
tool that creates a Database that can be used to
verify the integrity of files.

As modern filesystems (ext2, ufs, etc) implement fast
symlinks to store target's pathname, if only checksums
options (sha1, md5, tiger, etc) are used to check the
integrity of a soft link file, AIDE will not be able
to detect changes made on it.

If you use a mtime/ctime option, and somebody change a
target's pathname, AIDE will show it, but these
options are easy trickly with a standard Unix "touch"
command (and root privilege, of course).

So, I added the new option "l" to AIDE, to implement a
target's pathname comparison for symbolic links
against the database.  If a target's pathname is
changed on a symlink file, the difference will be

Please upgrade your AIDE tool to the last version
available (>= 0.13-r1)

Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis! 
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar

  By Date           By Thread  

Current thread:
  • AIDE problem handling symlinks fryxar fryxar (Nov 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]