Text 7438, 61 rader
Skriven 2006-09-09 19:08:00 av Paul Rogers (1:105/360.0)
     Kommentar till en text av Wayne Chirnside
Ärende: Just checking
=====================
My first Linux systems were "publishers edition" RHL6.1 CD's I got from
books.  Then I rescued a Linux From Scratch 4.1 CD, and began building
my own systems from home compiled code--similar to Gentoo.  The first
time I just went at it, even though I knew I needed "package
management", because I wasn't even sure I could do it at all.  (Pascal
Schmidt, and this goup, were a big help.)  After that I found a simple
Guarded Installation Tool that watches what changes between then and now
as a package is installed, and builds a script that will remove it all.
It can also tarball those files for backup.  That first system got
destroyed, but by then I started on new build.  My build scripts used
git (Linus now uses that name for something else) for each package all
the way through, and made immediate backups for use to clone/restore my
system.  I haven't yet installed "intrusion detection", e.g. tripwire
which basically computes a fancy checksum on system files, because I'm
still building.

After what happened to you I decided to write a script that would unball
those backups to a temporary branch and compare them to the originals.
I'll add that function to my git.  ARGH!  It doesn't work!  The last
step of LFS, after it is booted and works, is to strip all the debugging
stuff the compiler leaves in binaries: symbol table, etc.  /bin/cp went
from 328K to 53K, saving 84%.  So all the core binaries have "changed."
;-(  (I'll need to add stripping to the script I want to run to check
now, but it shouldn't really be part of git.)

Continuing work on the system, sometimes I found something I wanted to
change/add in a package afterward, say a configuration file.  I'd fix
the system file and test it, and the build script.  But since some
builds can take hours, often I'd adjust the git script if necessary and
backup the package again.  See the problem?  What if I'd gotten a
trojan in some program in the package since it was built?  It would now
be in my backup!  In any event, I can't be absolutely sure the files
backed up are the originals.  (I'll find out once I run my "validate"
script on stripped versions.)  I should add yet another function to git
so I can update the tarballs with just the files I modified.  OK, if tar
is the trojan, I'm screwed.

I know you're not building a system from scratch, where information
about what belongs with what, where it came from, and cleanly removing
it with it's buddies, is important.  What I'm suggesting is:  Think
about package & configuration management as soon as possible.  Start a
system-wide Change Log where you record what you're messing with, what
you change, and how to recover.  Be scrupulous about documenting
everything in the Change Log.  Plan your recovery path(s) for every
change you make.  Plan/document a total system recovery plan.  Get/use
tools, like tripwire, that not only can tell you if you've been hit, but
can also tell you all the system files are OK!  Think long & hard about
what you've got covered, what still isn't, and even what exposures
you've created--like my mistake above.  You're going to make a mistake
sometime, we all do.  Plan for it!  Before it happens, that is.


Paul Rogers, paulgrogers@yahoo.com                       -o)
http://www.angelfire.com/or/paulrogers                   /\\
Rogers' Second Law: Everything you do communicates.     _\_V

... If you don't make waves, you're not underway yet.
___ MultiMail/MS-DOS v0.35

---
 * Origin: The Bare Bones BBS (1:105/360)