<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
There is a way to protect files from any changes - even root can't change them. Set the "immutable" bit.
<br />
<br />Besides the standard file attributes in a Linux ext2/3/4 filesystem, there are extended attributes. One of them is the immutable bit. It prevents any changes to the file - whether by the system, by a user, or by root. Check the extended attributes in a directory using the "lsattr" command. It works like the "ls" command, but shows the extended attributes. If the immutable bit is set - there will be a "i" listed against that file. Change it with "chattr".
<br />
<br />So to protect the /etc/procmail file, use "chattr +i /etc/procmail" command. And you can verify the change took by using "lsattr /etc" and look for the lowercase i in front of the procmail filename. And if you really want to check it - try vi'ing the file afterward. You won't be able to make any changes.
<br />
<br />This is how I protect my custom IPTables rules from BQ and BX. I don't know why - but BQ/BX keeps making changes to that configuration file in /etc/sysconfig. So I just set it immutable and nothing can change it. My primary reason for this - I don't want my servers accepting TCP port25 connections from anything but our Roaring Penguin SPAM filter. That's how I lock out all the scumbags who send SPAM by IP address instead of using the MX records.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br /><font size="2"><b>---------- Original Message
-----------</b>
<br />
From: Menno Jansz <menno@jansz.com>
<br />
To: blueonyx@blueonyx.it
<br />
Sent: Thu, 04 Mar 2010 11:47:07 +0000
<br />
Subject: [BlueOnyx:03804] Re: Changing procmail from mbox to Maildir
<br />
<br />>
Thanks for all the info Tobias, that has confirmed what I have researched and
<br />>
filled in some missing gaps.
<br />>
<br />>
> 1) You have to protect your changed /etc/procmail somehow - this file is
<br />>
> changed by some rpm-updates without notice.
<br />>
<br />>
I have been thinking about this, and couldnt figure out a way I could stop yum
<br />>
updates from overwriting files. Does anyone have a way to protect files?
<br />>
<br />>
That is my main worry about changing over the server to qmail. Dont
<br />>
want to all
<br />>
off a sudden find the config changes reversed by some yum update.
<br />>
<br />>
As the old server I'm moving accounts from is qmail, it would really be
<br />>
simpler
<br />>
to be able to just stick with qmail.
<br />>
<br />>
Cheers,
<br />>
Menno
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>