0

Possible Duplicate:
What security policies exist in place for packages and scripts?

Originally I want(ed) to know how the Ubuntu update process is being secured against tampering of packages by a man in the middle. I asked this question: Are Virus/rootkits via Ubuntu updates possible? [closed]

It was closed as a duplicate, but the supposed duplicates cover some quite different topics (like how cd/flashdrive autorun etc affects safety etc.). So I've reposted my specific question. How is the update process secured against a man in the middle attack?

I feel this question is not really covered by:

1
  • On that page find "gpg" and you should be reading the exact part of the answer that is relevant. Apt warns you of packages signed by GPG keys you don't already have approved. Sep 21, 2012 at 9:14

1 Answer 1

0

Debian (antecedent of Ubuntu) already introduced SecureApt or apt-secure and Ubuntu implements this. As far as I understand, this SecureApt is a way to ensure package integrity using md5sum checking.

When apt-get update is run a file called packages.gz that contains md5sum hashes of packages in the repository is downloaded (securely??) and then when installing a package from the repo the downloaded package is md5sum checked against the packages.gz md5sum and installed only if it matches.

Therefore tampering or manipulation of a packaged should result in a "no match" md5sum comparison.

This does not explain how packages updates which cannot be known at the time of system install or "package.gz" file transmission will be verified, however.

Update

I found some more information here in the Ubuntu help page on SecureApt:

About the updated process and its safety/security implications:

  • There is a release file which contains the md5sums of packages (maybe this file is or contains the packages.gz mentioned earlier).
  • This release file is transmitted rather safely by using gpg key signing.
  • The release file is updated each time packages are updated. This explains how updates will be possible safely. (1. gpg signed release file transmitted with md5hashes of packages, 2. (update)packges transmitted and checked with the trusty md5sums of the relaese file)
2
  • 1
    If you think this adds value to the previous question, just add it to the packages/scripts question. Sep 21, 2012 at 9:14
  • nice suggestion. Nonetheless -as commented by yourself- on that question there is already the remark about gpg signing is used to make the repo safe. And incidently people here are keen of having NO DUPLICATES whatsoever so I won't invest time and post something, which is already there. Never mind it might be clearer or easier to understand. This page is for having surely no duplicates and not for help and understanding :) Sep 21, 2012 at 10:18

Not the answer you're looking for? Browse other questions tagged .