2

I need an Ubuntu installation that I can be 100% certain has no root kits etc. Unfortunately, buying the CDs on the Ubuntu store would cost me roughly $25 plus shipping and handling (pretty steep for a free OS).

But if I download it to my desktop, I can't be 100% sure that it will not be compromised because I can't be 100% sure that my desktop is not compromised (I'm roughly 95% sure my desktop is clean).

Am I overlooking an obvious way to achieve this result?

(It seems to me there should be a way to buy a single LTS CD for a couple dollars so that people can start fresh with an installation they know is uncompromised.)

Improve this question
1
  • 2
    Even though it is unlikely for an iso to get 'infected' when downloaded from a safe site like ubuntu.com, you can buy one from osdisc.com if you want to... But then how do you know THEY are not 'infected'?
    – Scott Goodgame
    May 28, 2013 at 21:34

1 Answer 1

Reset to default
3

md5sum

The cheapest way with a 100% guarantee that the ISO you've downloaded is not compromised is by running a md5sum on the ISO AND running a similar routine on the burnt CD.

The program md5sum is designed to verify data integrity using the MD5 (Message-Digest algorithm 5) 128-bit cryptographic hash. MD5 hashes used properly can confirm both file integrity and authenticity.

Both how to run the md5sum on the ISO and the CD is fully documented in the community wiki link but in summary:

md5sum ubuntu-12.04.2-desktop-amd64.iso
  • find the size of your ISO you've downloaded via
ls -l ubuntu-12.04.2-desktop-amd64.iso

Then use this value to test the CD:

dd if=/dev/cdrom bs=1 count=[insert your ls-l number here] | md5sum
Improve this answer
3
  • You don't need to use dd, you can just run md5sum /dev/cdrom
    – psusi
    May 29, 2013 at 0:45
  • @psusi - according to the wiki However this will almost NEVER be the same hash as the iso image that was burned to the disk, because this command includes the empty space at the end of the disk, which changes the hash. So you must check only the part of the disk that was on the iso.
    – fossfreedom ♦
    May 29, 2013 at 7:44
  • Since most of the pages under UbuntuHashes are not HTTPS, there's minimal guarantee of the authenticity of the md5sum
    – raphael
    Feb 29, 2016 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .