Unit 10: Packages, signatures and patching · Lesson 3 of 5 · 16 min

Verifying installed files

dpkg remembers the hash of every file it installed. Ask it what changed.

mission

You are
You are checking whether anyone edited packaged files on web01.
Situation
Someone may have patched a script by hand instead of shipping a new package.
Goal
Verify the in-house packages and show exactly what changed.
Hand in
The changed file and the difference.

What dpkg remembers

  1. Installdpkg stores an MD5 for every file
  2. Someone edits a fileOutside the package manager
  3. dpkg --verifyFlags the changed checksum
  4. ReinstallThen find out who edited it
01

Ask dpkg

Each line flags a file whose state differs from install time. A 5 in the third column means the MD5 changed.

learner@root-lab
dpkg --verify shop-tools shop-forms
??5??????   /usr/lib/shop-tools/check.sh

you should see One file in shop-tools changed.

dpkg
Lists and inspects the packages installed on Debian and Ubuntu. Built into Debian and Ubuntu.
02

Compare with the original

The original file is still inside the .deb.

learner@root-lab
dpkg-deb --fsys-tarfile /srv/mirror/pool/shop-tools_1.4.2_all.deb | tar -xO ./usr/lib/shop-tools/check.sh | diff - /usr/lib/shop-tools/check.sh
2a3
> echo "TEST-FIXTURE: edited outside the package manager"

you should see One line was added after install.

dpkg-deb
Inspects a .deb package file without installing it. Built into Debian and Ubuntu.
tar
Packs files into an archive or unpacks one. Built into Linux and macOS.
diff
Shows the lines that differ between two files. Built into Linux and macOS.
03

Run the wider check

Configuration files (marked c) change by design. Everything else should not.

learner@root-lab
dpkg --verify 2>/dev/null | grep -v ' c ' | wc -l
1

you should see Only the one file across all packages.

grep
Prints the lines of text that match a pattern. Built into Linux and macOS.
wc
Counts lines, words and bytes. Built into Linux and macOS.

What a defender takes away

  1. 1dpkg --verify finds edited packaged files.
  2. 2Config file changes are normal; binary and script changes are not.
  3. 3Fix by reinstalling the package, then find out who edited it.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.