Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose someone got root access to my machine and replaced some files, e.g.

Warning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable
Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executable
Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executable
Warning: The file properties have changed:
         File: /usr/bin/lynx
         Current hash: 95e81c36428c9d955e8915a7b551b1ffed2c3f28
         Stored hash : a46af7e4154a96d926a0f32790181eabf02c60a4
Warning: The file properties have changed:
         File: /usr/bin/perl
         Current hash: 9421cf93b65a5f19bcd488701829b467ebdee94e
         Stored hash : cf8654ebebf4090950b2d08a48e793f5971dbbe0
         Current inode: 1187480    Stored inode: 1272435
         Current file modification time: 1353976294 (27-Nov-2012 04:31:34)
         Stored file modification time : 1303497765 (22-Apr-2011 22:42:45)
Warning: The file properties have changed:
         File: /usr/bin/rpm
         Current hash: 9b04ded7ba468b19f06d4d0e37be0e6845a4800a
         Stored hash : 0480bbd95f7f2f674476c431002fbe276a3fe160
         Current inode: 1237990    Stored inode: 1241342
         Current file modification time: 1358445795 (17-Jan-2013 22:03:15)
         Stored file modification time : 1261508004 (22-Dec-2009 21:53:24)
Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script text executable
Warning: The file properties have changed:
         File: /usr/bin/lynx.cur
         Current hash: 95e81c36428c9d955e8915a7b551b1ffed2c3f28
         Stored hash : a46af7e4154a96d926a0f32790181eabf02c60a4
         Current inode: 1188390    Stored inode: 1239733
         Current file modification time: 1353340520 (19-Nov-2012 19:55:20)
         Stored file modification time : 1262672629 (05-Jan-2010 09:23:49)

debsums shows all OK, but what if installed packages checksums were upated along the files?

Can I verify local checksums to ones in repositories?

share|improve this question
    
You want to do this as a preventative measure (i.e. check it on a regular basis using a cron job), or as a corrective measure? If the latter, don't bother. Just reinstall a clean version of the affected packages (or of the whole system, really). If any local modifications were actually legit, well, they should have used dpkg-divert. – Celada Feb 14 '13 at 1:25
    
I appreciate your comment, Celada. Actually I want to do this as a corrective measure, and yes, I'm going to reinstall these packages. Thank you for mentioning dpk-divert, I didn't know of it. If you create the answer, I'll close my question as solved. – zuba Feb 14 '13 at 9:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.