Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When trying to install tmux I get an error that Untrusted packages could compromise your system's security, similar to the situation in this thread. I ran aptitude update and the package installed without issue, but I am concerned that the update may have been compromised. My concern in enhanced as I see that the update was done without SSL (http address):

 - neptune():~$ sudo aptitude update
Ign http://il.archive.ubuntu.com quantal InRelease
Ign http://il.archive.ubuntu.com quantal-updates InRelease
Ign http://il.archive.ubuntu.com quantal-backports InRelease
Get: 1 http://il.archive.ubuntu.com quantal Release.gpg [933 B]
Get: 2 http://il.archive.ubuntu.com quantal-updates Release.gpg [933 B]
Get: 3 http://il.archive.ubuntu.com quantal-backports Release.gpg [933 B]
Hit http://il.archive.ubuntu.com quantal Release
Get: 4 http://il.archive.ubuntu.com quantal-updates Release [49.6 kB]
Ign http://security.ubuntu.com quantal-security InRelease
Ign http://archive.canonical.com quantal InRelease
Ign http://extras.ubuntu.com quantal InRelease
Ign http://dl.google.com stable InRelease
Ign http://ppa.launchpad.net quantal InRelease
Ign http://deb.opera.com stable InRelease
Ign http://ppa.launchpad.net quantal InRelease

EDIT: I have now been made aware that the targeted attacking of Israeli websites on April 7 has already begun. Therefore, there is increased suspicion of a compromised server. I could find more information about the attack if necessary, though I don't see much mention of it in widespread English-language news websites.

Clarification: I'm asking how to ensure that what I've already downloaded and installed is not compromised. I am not asking how Canonical ensures the security of repos.

share|improve this question
    
Have you considered tunnelling out over TOR? It might be a slow update but it'd be secure. –  Gregology Apr 5 '13 at 15:09
1  
@Gregology Tunnelling won't make the package itself more secure if it was compromised, and is being pulled from the same server. One would need to use an actual different server that has not been compromised, and has the properly signed packages. –  dobey Apr 5 '13 at 15:20
1  
Hi @dobey, I disagree. Tunnelling over TOR will make a man in the middle attack very unlikely and if the actual server has been compromised then packages could be falsely signed anyway. I would suggest using another server though. What are you thoughts @dobey? –  Gregology Apr 5 '13 at 15:28
    
@Gregology You're assuming it's a MitM attack. And I think this question is a duplicate. I'd suggest using a different mirror of course. :) –  dobey Apr 5 '13 at 15:48
    
Thanks, all. Had I been concerned before downloading, then this would be a dup (i.e., how do I know that the repo is safe). However, I'm now asking how to ensure that what I've already downloaded and installed is not compromised. –  dotancohen Apr 5 '13 at 15:53

2 Answers 2

up vote 3 down vote accepted

I cannot tell you how you do it for all packages, but here is a possible procedure for single packages.

Warning: The site I suggest to use does (strangely) not support https yet - so you cannot be certain that you are really talking to the correct site, which makes the check much less useful than expected - as Eliah Kagan pointed out in a comment.

  1. visit packages.ubuntu.com
  2. select your distro
  3. select "all packages" (down at the bottom)
  4. look into /var/cache/apt/archives and choose suspicious packages (for instance those with a recent date)
  5. run a sha256sum against that package
  6. choose that package on the website, you get enter image description here
  7. click on the link beneath Architecture enter image description here
  8. compare the result from step 5 with the published value.
share|improve this answer
    
Great, thank you very much! –  dotancohen Apr 5 '13 at 19:57
    
Interestingly, the site does not show a result when I search for tmux_1.6-2_amd64 or tmux_1.6-2_amd64.deb, but google takes me to the right page. –  dotancohen Apr 5 '13 at 20:00
5  
Manually checking the hashes of your packages like this won't make you any more secure--they are already checked automatically by APT for any package automatically downloaded. And packages.ubuntu.com is not SSL-secured; if you don't trust the hashes that are GPG-signed, why trust hashes obtained naively from an HTTP site?? –  Eliah Kagan Apr 5 '13 at 20:14
1  
@EliahKagan the question was about the warning "Untrusted packages could compromise..." –  guntbert Apr 5 '13 at 20:16
3  
@guntbert But this is still an insecure way to verify a package's integrity or authenticity. I've removed my comment on the question (I'm no longer so sure this is a duplicate). But this answer still has the severe shortcoming that it uses an untrusted channel to obtain the sha256 hash. Furthermore, by presenting your method as "the procedure," you're strongly suggesting that this is widely considered a secure method. Under some circumstances this may be better than nothing, but isn't there another way to check them? Launchpad? (Which is HTTPS-secured, and is where the packages originate.) –  Eliah Kagan Apr 5 '13 at 20:17

Don't worry.

As Eliah explained in his comment, APT is secured using GnuPG. The public keys for the archives of Ubuntu are installed on your system and you should check those. After every download the file will be checked for integrity by the GPG/PGP signature and thus you can be sure nobody has tampered with. In case that fails, you'll see the exact warning you got in the first place.

A more thorough explanation, how to find and validate keys is described here: Ubuntu Community wiki: SecureApt

Using SSL won't make it more secure. The only thing you'll be hiding for all peers in between you and the archive server is what you're transferring/downloading and it won't protect anything more in respect to integrity.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.