This is a follow-up to bug #445661. On top of that, `rkhunter --enable hashes`
should be run *before* a package upgrade, to ensure that nothing has been
compromised since the last cron run.

Of course, there is still the chance of a compromise happening during the
upgrade, but this reduces the time window significantly...

Hi,

Le jeudi 18 mars 2010 à 22:22 +0000, Ximin Luo a écrit :

mmh I would rather say *you* have to run rkhunter before you use
aptitude.

I can hardly imagine that rkhunter is run twice in a row automatically.

Cheers,
Julien

Your logic doesn't follow. The two runs don't do the same thing; the
pre-install run checks that all the hashes are OK, and the post-install run
updates all the hashes.

If there were some way to make --propupd update only the hashes that were
modified as part of the install process, then the pre-install run wouldn't be
needed, but this is not the case.

X

Hi,
run

You are right, I had misunderstood it.

I will have a look at it during the week-end, but this would require extra
configuration in case something wrong is found (ie. stop the upgrade
process).
were
wouldn't

There is such a possibility in rkhunter, but I haven't managed (yet) to
implement it correctly in the Debian package. See #512087

I do not see any "easy" way to implement this, apart from using
dpkg-triggers from the watched packages, but this would require much
coordination between a lot of Debian developers.

I had tried doing it directly in the rkhunter package (ie by detecing
which files were updated) but it is not reliable.

Also, the process is almost as long as updating the whole database, hence
almost no speed win in that case.

Cheers,
Julien