Use of metadata signature filter

[Peter Schober]

Another take on this, taking the question literally...

* Paul Hethmon <paul.hethmon at clareitysecurity.com> [2012-02-14 17:04]:
> So if I do my normal file based load of their metadata, what purpose
> does signature validation serve?

None, for the most part. The key would protect the metadata from
tampering, but what about metadata plus key being tampered with?
Whatever restriction (read-only medium, read-only filesystem, file
system permissions, etc.) you'd chose to protect the verification key
from being tampered with, you could apply those same to the metadata
file.

So that would only make a little sense if the metadata changed often,
because -- in comparison -- the key won't. Then having the key on a
read-only medium would prevent tampering, but a root exploit would
still allow for software reconfiguration to not use the key at all
(e.g. disable the filter, point it at a different key).
So you'd then need a host-based IDS (e.g. tripwire) or monit and/or
cfengine/puppet to automate checking and/or replacement of changed
files, etc.
Having those then monitor the key only (and any configuration
referencing this exact key; and making sure the right processes are
running, not some other copy of the IdP etc.pp. :) ) would spare you
false alarms (or IDS database updates on a different host) if the
local metadata file actually needs to be changed.
-peter