Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Does apt-get use https or any kind of encryption? Is there a way to configure it to use it?

share|improve this question

2 Answers 2

up vote 11 down vote accepted

apt-get (and other package manipulation commands, which are a front-end to the same APT libraries) can use HTTP, HTTPS and FTP (and mounted filesystems). If you specify https:// URLs in /etc/apt/sources.list and /etc/apt/sources.list.d/*, then APT will use HTTPS.

APT verifies the signature of packages. So you do not need to have a form of transportation that provides data authentication. If an attacker modifies the files you're downloading, this will be noticed. Using a signature verification is better than using an HTTPS connection, because it'll detect an attack on the server you're downloading from, not just an attack in transit.

More precisely, the (simplified) data flow for a package is the following:

  1. The package is produced on a build machine.
  2. The package is signed on the build machine.
  3. The signed package is copied to a download mirror.
  4. You download the package.

HTTPS ensures that step 4 happens correctly. The package signatures ensure that steps 2 to 4 happen correctly.

In fact, there is one small benefit to HTTPS for step 4: the package signatures only ensure that the package is authentic. An attacker in step 4 could impersonate a legitimate server and serve stale versions of the package. For example, the attacker could prevent you from downloading any security updates, in the hope of exploiting a vulnerability on your machine that you would have patched if it wasn't for the attack. This isn't a very realistic scenario, because it requires an active attacker (so that would have to be someone in control of your Internet connection), but it could happen in principle.

The other benefit to HTTPS would be if you're trying to hide the fact that you're downloading Ubuntu packages from someone snooping on your network connection. Even then, the eavesdropper could see what host you're connecting to; if you connect to an Ubuntu mirror and download hundreds of megabytes, it's clear that you're downloading Ubuntu packages. The eavesdropper could also mostly figure out which packages you're downloading from the size of the files. So HTTPS would only be useful if you're downloading from a server that also offers other files of similar size — I don't see any point except for third-party packages, and only in very unusual circumstances.

To reiterate: the usual benefit of HTTPS, which is that you know you're connected to the real server, is useless when you're downloading Ubuntu packages. The signature verification on packages gives a stronger guarantee than what HTTPS can provide.

share|improve this answer
    
Can you provide more information (or a reference) for the claim that SSL (via HTTPS) is less secure than apt-get's hashing? –  Eliah Kagan Jun 4 '12 at 0:25
3  
It's not that it's less secure, it's that it's less relevant to what you are trying to protect. With APT, encrypting the contents of your transaction is not so important, because what you're downloading is very uncontroversial: it's just the same Ubuntu packages that lots of people download. But what is important, is ensuring that the files as you receive them haven't been tampered with. –  neon_overload Jun 4 '12 at 0:31
1  
Some weeks ago I tried to change sources to https and it simply didn't work, apt-get update would report error when trying to access the links. With ppas: the same. Have anyone tried it? –  Strapakowsky Jun 4 '12 at 1:30
5  
The repository (update server) must support https/SSL for this to work. The main archive.ubuntu.com does not. You can check in your browser if a server supports it by prefixing https:// to the URL and seeing if you get a list of directories, etc. –  izx Jun 4 '12 at 2:48
3  
"An attacker in step 4 could impersonate a legitimate server and serve stale versions of the package." Actually, we protect against this by giving package information an expiry date. APT will warn after this date that your mirror is stale. –  tumbleweed Jun 5 '12 at 1:07

With APT, typically what is more important is not that your connection is encrypted, but that the files you are receiving haven't been tampered with.

APT has built-in signature verification to ensure this.

Encryption would prevent eavesdroppers from being able to see what you are downloading, but what you are actually downloading (and requesting) is pretty uncontroversial: it'll be the same as thousands of other Ubuntu users are downloading and the files contain nothing that isn't freely available on lots of servers. Still, if you need privacy about what packages in particular you're downloading, HTTPS can be used (specify it in your sources.list).

The signature verification that is built in to APT will ensure that the files you receive have not been tampered with. It doesn't really matter where the files come from and it's even possible to have proxies or reverse proxies in between you and the server to reduce server load or speed you up. The signature verification still ensures that you are getting the unmodified file, matching the signature that could only be cryptographically produced with the original file and a copy of Ubuntu's private key.

If you switch to HTTPS, then you won't be able to take advantage of proxy servers for speeding up access or reducing load anymore. And it wouldn't add any more assurance about non-tampering that APT's signature verification doesn't already give. It would, however, mean that eavesdroppers (such as your ISP) will not be able to see which packages you're downloading (which is not likely to be confidential, and as Gilles pointed out they could guess from the file size).

share|improve this answer
    
HTTPS won't give much privacy, because the size of the files is visible. There is in fact a small benefit to HTTPS, which is that it ensures that an attacker in control of your network connection cannot silently slip in stale data. It's a bit far-fetched. –  Gilles Jun 4 '12 at 0:40
    
Good points. By "stale data" I presume you mean a man-in-the-middle setting up a version of the Ubuntu mirror comprised of slightly earlier versions, but still unaltered from what Ubuntu had signed at the time. –  neon_overload Jun 4 '12 at 0:50
    
Yes, that's it. Don't hesitate to point out if I'm a bit jargony — I need to keep in mind that this is Ask Ubuntu and not Information Security. –  Gilles Jun 4 '12 at 1:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.