Unit 10: Packages, signatures and patching · Lesson 3 of 5 · 16 min

Verifying installed files

dpkg remembers the hash of every file it installed. Ask it what changed.

mission

You are
You are checking whether anyone edited packaged files on web01.
Situation
Someone may have patched a script by hand instead of shipping a new package.
Goal
Verify the in-house packages and show exactly what changed.
Hand in
The changed file and the difference.

What dpkg remembers

  1. Installdpkg stores an MD5 for every file
  2. Someone edits a fileOutside the package manager
  3. dpkg --verifyFlags the changed checksum
  4. ReinstallThen find out who edited it
01

Ask dpkg

Each line flags a file whose state differs from install time. A 5 in the third column means the MD5 changed.

learner@root-lab
dpkg --verify shop-tools shop-forms
??5??????   /usr/lib/shop-tools/check.sh

you should see One file in shop-tools changed.

02

Compare with the original

The original file is still inside the .deb.

learner@root-lab
dpkg-deb --fsys-tarfile /srv/mirror/pool/shop-tools_1.4.2_all.deb | tar -xO ./usr/lib/shop-tools/check.sh | diff - /usr/lib/shop-tools/check.sh
2a3
> echo "TEST-FIXTURE: edited outside the package manager"

you should see One line was added after install.

03

Run the wider check

Configuration files (marked c) change by design. Everything else should not.

learner@root-lab
dpkg --verify 2>/dev/null | grep -v ' c ' | wc -l
1

you should see Only the one file across all packages.

What a defender takes away

  1. 1dpkg --verify finds edited packaged files.
  2. 2Config file changes are normal; binary and script changes are not.
  3. 3Fix by reinstalling the package, then find out who edited it.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.