From owner-freebsd-chat Fri Sep 15 10:55:35 2000 Delivered-To: freebsd-chat@freebsd.org Received: from smtp.nwlink.com (smtp.nwlink.com [209.20.130.57]) by hub.freebsd.org (Postfix) with ESMTP id 6AF7F37B422 for ; Fri, 15 Sep 2000 10:55:34 -0700 (PDT) Received: from utah (jcwells@utah.nwlink.com [209.20.130.41]) by smtp.nwlink.com (8.9.3/8.9.1) with SMTP id KAA03040; Fri, 15 Sep 2000 10:55:32 -0700 (PDT) Date: Fri, 15 Sep 2000 11:08:21 -0700 (PDT) From: "Jason C. Wells" X-Sender: jcwells@utah To: Lowell Gilbert Cc: freebsd-chat@FreeBSD.ORG Subject: Re: Tripwire vs. Mtree In-Reply-To: <44og1p5yy5.fsf@lowellg.ne.mediaone.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-chat@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On 15 Sep 2000, Lowell Gilbert wrote: > Remember, there's a chicken-and-egg problem: if your system is > compromised, you can't trust its mtree executable to detect the fact. > Even if you have a "safe" copy of the executable, you can't trust the > system's standard libraries, because those may have been compromised too. > > If you had a statically linked version of mtree on the floppy where you > keep the checksums, mtree would be roughly as good as tripwire, although > not as convenient, and certainly the tripwire option to build a standalone > floppy would take a bit of work to emulate. Having never directly used either ubt knowing what they do, I now see that there are "implementation" issues that have to be considered. Thank you for the input. I would have neglected to consider the trustworthiness of the system libraries. Thank you, Jason C. Wells To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-chat" in the body of the message