Re: File Integrity Check

["Steven M. Bellovin" <smb () research att com>]

In message <37B41E16.90C97437 () arris-i com>, Russell Enderby writes:
> In pursuit of determining critical system files for modifications I was
> thinking the checksum prog 'sum' would be sufficient.  Understanding
> that time,date, and file size can be modified under the ext2fs/ufs
> directory table.  Is it possible to also make the 'sum' checksum appear
> to be correct?

'sum' is not sufficient; spoofing it is trivial.
> I was under the impression tripwire uses its own special checksum prog
> to verify files, although would 'sum' be sufficient as well?  If not
> does anyone know of better more thorough checksum app?

Tripwire uses a cryptographic checksum such as MD5 or SHA-1.  For this 
purpose, that's what you need.