Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need an Ubuntu installation that I can be 100% certain has no root kits etc. Unfortunately, buying the CDs on the Ubuntu store would cost me roughly $25 plus shipping and handling (pretty steep for a free OS).

But if I download it to my desktop, I can't be 100% sure that it will not be compromised because I can't be 100% sure that my desktop is not compromised (I'm roughly 95% sure my desktop is clean).

Am I overlooking an obvious way to achieve this result?

(It seems to me there should be a way to buy a single LTS CD for a couple dollars so that people can start fresh with an installation they know is uncompromised.)

share|improve this question
Even though it is unlikely for an iso to get 'infected' when downloaded from a safe site like, you can buy one from if you want to... But then how do you know THEY are not 'infected'? – Scott Goodgame May 28 '13 at 21:34


The cheapest way with a 100% guarantee that the ISO you've downloaded is not compromised is by running a md5sum on the ISO AND running a similar routine on the burnt CD.

The program md5sum is designed to verify data integrity using the MD5 (Message-Digest algorithm 5) 128-bit cryptographic hash. MD5 hashes used properly can confirm both file integrity and authenticity.

Both how to run the md5sum on the ISO and the CD is fully documented in the community wiki link but in summary:

md5sum ubuntu-12.04.2-desktop-amd64.iso
  • find the size of your ISO you've downloaded via
ls -l ubuntu-12.04.2-desktop-amd64.iso

Then use this value to test the CD:

dd if=/dev/cdrom bs=1 count=[insert your ls-l number here] | md5sum
share|improve this answer
You don't need to use dd, you can just run md5sum /dev/cdrom – psusi May 29 '13 at 0:45
@psusi - according to the wiki However this will almost NEVER be the same hash as the iso image that was burned to the disk, because this command includes the empty space at the end of the disk, which changes the hash. So you must check only the part of the disk that was on the iso. – fossfreedom May 29 '13 at 7:44
Since most of the pages under UbuntuHashes are not HTTPS, there's minimal guarantee of the authenticity of the md5sum – raphael Feb 29 at 20:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.