Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote -1 down vote favorite

Possible Duplicate:
What security policies exist in place for packages and scripts?

Originally I want(ed) to know how ubuntu update process is being secured against tampering ofpackages by a man in the middle. This has been this question here: Are Virus/rootkits via ubuntu updates possible? [closed]

It has been closed for being assumed to be a duplicate. Still the assumed duplicates cover some quite different topics (like how cd/flashdrive autorun etc effects safety etc.). So I post the question again. I seek an answer to how the updated process is secured against a man in the middle attack.

Pardon me for the potential annoyance, but the topic deeply interested me since there are quite many updates in ubuntu (at least one security update each week) and knowing what way this updates can be a path for malware is important to me.

Maybe somebody will be a nice fellow and able to bring some light to this question. I would also dearly appreciate that with some less ignorance the question will remain opened this time, for indeed it is not totally the covered by the questions:

and still not well enough in

neither of the "duplicates" covers the aspect how the update process is secured.

share|improve this question
On that page find "gpg" and you should be reading the exact part of the answer that is relevant. Apt warns you of packages signed by GPG keys you don't already have approved. – Call me V Sep 21 '12 at 9:14

marked as duplicate by Call me V, ObsessiveSSOℲ, Mitch, LnxSlck, Anwar Sep 21 '12 at 15:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote -1 down vote

Debian as the related distribution already intruduced SecureApt or "apt-secure" and so does Ubuntu. As far as I understood by now this SucureApt is a way to approach the package integraty by using md5sum for packages know. When doing a apt-get update a file called packages.gz that contains md5sum hashes of packages in the repository is downloaded (securely??) and then when installing a package from the repro the downloaded package is md5sum checked against the packages.gz md5sum and installed when it fits.

Therefore tampering or manipulation of a packaged should result in a "no match" md5sum comparison.

Anyhow this does not explain how the "update packages" which cannot be know at the time of system install or "package.gz" file transmission will be verified?

Update

I add some more informative response to enhance the answer here. The informations is derived from the source https://help.ubuntu.com/community/SecureApt:

About the updated process and its safety/security implications:

  • There is a release file which contains the md5sums of packages (maybe this file is or contains the packages.gz mentioned earlier).
  • This release file is transmitted rather safely by using gpg key signing.
  • The release file is updated each time packages are updated. This explains how updates will be possible safely. (1. gpg signed release file transmitted with md5hashes of packages, 2. (update)packges transmitted and checked with the trusty md5sums of the relaese file)
share|improve this answer
If you think this adds value to the previous question, just add it to the packages/scripts question. – Call me V Sep 21 '12 at 9:14
nice suggestion. Nonetheless -as commented by yourself- on that question there is already the remark about gpg signing is used to make the repo safe. And incidently people here are keen of having NO DUPLICATES whatsoever so I won't invest time and post something, which is already there. Never mind it might be clearer or easier to understand. This page is for having surely no duplicates and not for help and understanding :) – humanityANDpeace Sep 21 '12 at 10:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.