Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to verify that a downloaded iso is not being poisend by the NSA or any other immoral agent. To do this I would very much use a signing-checking way.

I am aware of VerifyIsoHowto. Still I am not very happy with offered. If some agent can manipulate one file download he surely can manipulate all file downloads. So the public key I get from a key-server can just be cheated to make the manipulated ISO file check okay, while indeed it has been injected a rootkit or worse.

Now I am aware of that there is unfortunatelly no 100% sure way. But starting with the assumption that my current system is safe I have those keys used in the SecureApt mechanism.

My Question therefore:

How can the keys that I already trust in SecureApt (= the ordinary Ubuntu repository keys) be used to verify a freshly downloaded ISO?

Indeed it would serve me well also if I could via the Ubuntu Repo (and hence in a deb that is verified implicitly via SecureApt) get those public keys which would be necessary to verify the signature of the iso.

Any help would be greatly appreciated.

PS: of course I am aware that if Canonical is immoral and colaborates with NSA (which has money hey) we are all poisend anyhow. Let's just assume something like this could never happen, ok?

share|improve this question
    
Downvote very much appreciated. After all privacy and verification of authenticity... that is total bullshit right? I mean the big brother NSA will just become mad... eh? –  humanityANDpeace Sep 23 '13 at 7:26

2 Answers 2

up vote 0 down vote accepted

The following steps allow to verify the SHA256SUMS file for the downloaded ubuntu iso.

  • (1) open Terminal CTRL-ALT-T
  • (2) import the keys from /usr/share/keyrings/ubuntu-archive-keyring.gpg via gpg --import /usr/share/keyrings/ubuntu-archive-keyring.gpg as a result you should have know an output like this:
  gpg: keyring `/root/.gnupg/secring.gpg' created
  gpg: key 437D05B5: public key "Ubuntu Archive Automatic Signing Key " imported
  gpg: key FBB75451: public key "Ubuntu CD Image Automatic Signing Key " imported
  gpg: Total number processed: 2
  gpg:               imported: 2
  gpg: no ultimately trusted keys found

The line

gpg: key FBB75451: public key "Ubuntu CD Image Automatic Signing Key " imported

shows you that you imported the gpg key for signing cd images (that is the isos) it is the one that has the following fingerprint:

Primary key fingerprint: C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451

and hence the ID FBB7 5451 - (3) having the key you can then download the files SHA256SUMS, MD5SUMS, SHA1SUMS and their respective signatures SHA256SUMS.gpg, MD5SUMS.gpg, SHA1SUMS.gpg from the servers you also downloaded the iso file. - (4) know you can use this command gpg --verify SHA256SUMS.gpg SHA256SUMS to check if the file SHA256SUMS is really the untampered/poisend version. If this is so then you should receive an output like this:

gpg: Signature made Thu 14 Feb 2013 06:38:41 PM CET using DSA key ID FBB75451
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451

elsewise something like this would show you that the file is not "good"

gpg: Signature made Thu 14 Feb 2013 06:38:41 PM CET using DSA key ID FBB75451
gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key "

or worse even this

gpg: CRC error; 30E596 - 3432FF
gpg: packet(2) with unknown version 0
gpg: no signature found
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

In essetial you advantage is that instead the following: the step 2 "get the key for the signature" from the howto refered also in the question above from the keyserver, which leaves you with the vulnerability to be spoofed a wrong key is prevented, because you will use the key as provided by your already in place ubuntu setup. If you think that you have a secure ubuntu setup and trust it you will hence have a benefit.

share|improve this answer

This seems to work nicely:

sudo apt-get install ubuntu-keyring
gpgv --keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg SHA256SUMS.gpg SHA256SUMS
grep ubuntu-14.04-desktop-amd64.iso SHA256SUMS | sha256sum --check
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.