checksum, file integrity check, cksum, md5sum

[Mehmet Musa_2]

Hi,

If the terms checksum, file integrity check, cksum or md5sum are of interest to you and/or pertinent to your project development activities, then please read through. If not, you can ignore the rest of this message.

We are interested in knowing in what ways file integrity checking is used, the frequency and the value of such functionality. Please take a few minutes to answer the following questions:

1)For what purpose do you use the HP-UX cksum command?
(for example: http download integrity check; ftp download integrity check; comparison of two file versions; as part of an
application; or other reason - please specify)

2)Does the functionality provided by cksum fulfill your present and future requirements adequately? If not, please explain.

3)Do you know of customers asking for more robust/secure file integrity checking for HP-UX? If yes, please elaborate.

4)Do you use (or plan to use) md5sum? If yes explain why.
If md5sum were available for HP-UX would you use it instead of cksum?

5)Have you ever downloaded a file and been unable to check its integrity
because you did not have the md5sum command on HP-UX? If so, what have you done and what has been the impact?

6)Would you use a programmatic interface (API) providing the same type of functionality? If so, please explain.

Thank you for your time.

--Mehmet

[Hai Nguyen_1]

1) ftp
2) somewhat adequate if the source is pretty trusted.
3) No.
4) Yes, to check file/dir integrity of systems exposed to the internet.
5) No.
6) No.

Hai

[Ramkumar Devanathan]

Hi Mehmet,

Sorry to interfere in your customer survey - cksum itself varies output between tru64 and hp-ux - the default on tru64 is a different algorithm - see man cksum on tru64. that is a bit confusing. tru64 cksum can be set to behave like hp-ux cksum if the env var CMD_ENV=xpg4.

I believe you are asking this bcos you are from the commands group and so my point above.

- ramd.

[Ted M Johnson_1]

1) cmd line file comparison
2) no. see below for expl.
3) yes. see below for expl.
4) yes
5) yes

For code compatability with Linux I tend to use md5sum() where possible simply to make my code a bit more portable. Publishing the md5sum of packages seems to be the standard way to verify file integrity, and IMO should be adopted by hpux.

Usually, some of the first tools I install on a new hpux server would be lsof() and md5sum().

I also

# rm /bin/more
# cp /usr/bin/less /bin/more

but that's another discusstion :-)

[George Spencer]

1. Test whether a file has been changed - simple security check of OS for tampering.
2. Mostly. Would like it to provide the equiv of public/priv key; that way even a simple security check could not be easily be "fixed" after file tampering.
3. No.
4. No, I prefer to use the tools built into a OS. But I will look md5sum up; now I know about it.
5. Yes.
6. Probably, No.

[harry d brown jr]

1)comparing files between two systems for a quick test (although its not 100% accurate, its good enough for a first level test)

2)sometimes

3)yes, me, one reason I downloaded md5sum

4)see 3

5)sure, before md5sum was available?

6)No need for that

live free or die
harry