Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual page 97

rpm --import /usr/share/doc/rpm-<version>/RPM-GPG-KEY
rpm -V package_name
The -V option verifies the files in the installed package called package_name. If it shows no
output and exits, this means that none of the files have been modified in any way since the last
time the RPM database was updated. If there is an error, such as the following
S.5....T c /bin/ps
then the file has been modified in some way and you must assess whether to keep the file
(such as with modified configuration files in the /etc/ directory) or delete the file and reinstall
the package that contains it. The following list defines the elements of the 8-character string
(S.5....T in the above example) that notifies of a verification failure.
• . — The test has passed this phase of verification
• ? — The test has found a file that could not be read, which is most likely a file permission issue
• S — The test has encountered a file that that is smaller or larger than it was when originally
installed on the system
• 5 — The test has found a file whose md5 checksum does not match the original checksum of
the file when first installed
• M — The test has detected a file permission or file type error on the file
• D — The test has encountered a device file mismatch in major/minor number
• L — The test has found a symbolic link that has been changed to another file path
• U — The test has found a file that had its user ownership changed
• G — The test has found a file that had its group ownership changed
• T — The test has encountered mtime verification errors on the file
rpm -Va
The -Va option verifies all installed packages and finds any failure in its verification tests (much
like the -V option, but more verbose in its output since it is verifying every installed package).
rpm -Vf /bin/ls
The -Vf option verifies individual files in an installed package. This can be useful when
performing a quick verification of a suspect file.
rpm -K application-1.0.i386.rpm
The -K option is useful for checking the md5 checksum and the GPG signature of an RPM
package file. This is useful for checking whether a package about to be installed is signed by Red
Hat or any organization for which you have the GPG public key imported into a GPG keyring. A
package that has not been properly signed triggers an error message similar to the following:
application-1.0.i386.rpm (SHA1) DSA sha1 md5 (GPG) NOT OK
RPM as an IDS
85