RPM Verify

It is always good to check that your system is OK. After all you could have contracted a nasty virus or worse a rootkit. On RPM based systems you can "verify" packages from when they were installed. It is very useful as long as your rpmdb hasn't been corrupted.

To do it all you need to do is this:

$ rpm -V mysql
S.5....T c /etc/my.cnf

So there is one file that is altered since install for that package.

The first 8 characters represent:

• S - file Size differs
• M - Mode differs
• 5 - MD5 sum differs
• D - Device major/minor number mismatch
• L - readLink path mismatch
• U - User ownership differs
• G - Group ownership differs
• T - mTime differs

So in the above example, the size, md5 and modified time have been altered since install. Most likely we have altered the config to our own wishes.

The small c character is an optional attribute, in this case specifying a configuration file. Here is the possible letters:

• c - A configuration file.
• d - A documentation file.
• g - A "ghost" file (the contents aren't in the package payload).
• l - A license file.
• r - A readme file.

All in all a very effective way of managing the security of your system.