Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Suppose someone got root access to my machine and replaced some files, e.g.

Warning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable
Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executable
Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executable
Warning: The file properties have changed:
         File: /usr/bin/lynx
         Current hash: 95e81c36428c9d955e8915a7b551b1ffed2c3f28
         Stored hash : a46af7e4154a96d926a0f32790181eabf02c60a4
Warning: The file properties have changed:
         File: /usr/bin/perl
         Current hash: 9421cf93b65a5f19bcd488701829b467ebdee94e
         Stored hash : cf8654ebebf4090950b2d08a48e793f5971dbbe0
         Current inode: 1187480    Stored inode: 1272435
         Current file modification time: 1353976294 (27-Nov-2012 04:31:34)
         Stored file modification time : 1303497765 (22-Apr-2011 22:42:45)
Warning: The file properties have changed:
         File: /usr/bin/rpm
         Current hash: 9b04ded7ba468b19f06d4d0e37be0e6845a4800a
         Stored hash : 0480bbd95f7f2f674476c431002fbe276a3fe160
         Current inode: 1237990    Stored inode: 1241342
         Current file modification time: 1358445795 (17-Jan-2013 22:03:15)
         Stored file modification time : 1261508004 (22-Dec-2009 21:53:24)
Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script text executable
Warning: The file properties have changed:
         File: /usr/bin/lynx.cur
         Current hash: 95e81c36428c9d955e8915a7b551b1ffed2c3f28
         Stored hash : a46af7e4154a96d926a0f32790181eabf02c60a4
         Current inode: 1188390    Stored inode: 1239733
         Current file modification time: 1353340520 (19-Nov-2012 19:55:20)
         Stored file modification time : 1262672629 (05-Jan-2010 09:23:49)

debsums shows all OK, but what if installed packages checksums were upated along the files?

Can I verify local checksums to ones in repositories?

share|improve this question
    
You want to do this as a preventative measure (i.e. check it on a regular basis using a cron job), or as a corrective measure? If the latter, don't bother. Just reinstall a clean version of the affected packages (or of the whole system, really). If any local modifications were actually legit, well, they should have used dpkg-divert. –  Celada Feb 14 '13 at 1:25
    
I appreciate your comment, Celada. Actually I want to do this as a corrective measure, and yes, I'm going to reinstall these packages. Thank you for mentioning dpk-divert, I didn't know of it. If you create the answer, I'll close my question as solved. –  zuba Feb 14 '13 at 9:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.