I am told I should do
rpm -Va because:
operating system must be configured so that the cryptographic hash of system files and commands matches vendor values... Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection
rpm -Va | grep '^..5' is done and if anything comes back that is supposed to be a problem.
From a clean install from DVD I can successfully meet that criteria.
However, I am also told to configure files such as
/etc/audit/audit.rules not to mention some obvious other ones to make a system functional, and changing these of course results in these files not matching vendor values, thus the
rpm -Va comes back with mainly
Can someone explain the purpose or rationale of this? As well as how
grep '^..5' is supposed to work? Is there a way to make this work such that -- yeah, I changed a .conf file, but have
rpm be updated to not flag specified packages as having been altered?