On Sun, 2009-02-15 at 20:31 +0100, Julien Valroff wrote: > > That was the plan for the last upload, upstream having now improved the > > --propupd option. > > However, I have found that running 'rkhunter --propupd' with one file or > > for all files almost takes the same time. > That was totally wrong, my system was in high load when testing this. > Actually, it would a great improvement for time and security to only > update the data for changed files. Ah ^^
> Combining --propupd <file> --nolog would be the best option for the time > aspect. Not sure about the security aspect as for the --nolog option. > What do you think? Well my knowledge is not so big about rkhunter,... I'm just a user of it. Generally I think: Security goes first, than comes the necessary time. But on the other hand (so far) I've never seen any log output by rkhunter -prpupd?! Where is it written to? I just see some very small messages on stdout (or err). > Actually, there are 2 issues (amongst others, for which workarounds can > be found): > > * The --propupd <file> feature will only work if the file is already > registered in the file properties database. This means that if a package > is installed, full db update should be run (or data added by an external > script which I am reluctant to do for security and maintenance reasons). > I will discuss with upstream to check what can be done in rkhunter to > fix this. > > * I have no idea how to deal with watched files which are in the > alternatives system. For now, I am able to compare the upgraded .deb > contents and compare with a static list of watched files. Alternative > files being symlinks, the post invoke script cannot detect them and will > hence fail to update the file properties database. > This is for example the case of unhide hmm,.. I see > I fear we will need to wait a bit before this can become reality... No problem,.. as long as this is logged here and won't be forgotten :-) > Any help, comment or suggestion are of course welcome! Well,.. again,.. I think I have to little knowledge about it to make deep comments ;) Thanks, Chris.
smime.p7s
Description: S/MIME cryptographic signature
