Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My vague understanding of the authentication mechanisms behind debian/ubuntu packaging tells me that it should be safe to install packages downloaded from an untrusted server or proxy as long as apt is able to verify them without issuing warning messages.

Is this correct?

For example, say I'm trying to connect to the standard ubuntu servers to do security updates (i.e. security.ubuntu.com). To reduce bandwidth consumption, I'm going through a local apt-cacher proxy, but it's possible that someone may have tampered with the packages cached on that proxy server. Or there may even be a transparent apt proxy along the line somewhere. Will I get a warning if the packages are not the correct ones? How does updating my apt cache (sudo aptitude update) affect this?

share|improve this question
add comment

1 Answer

You might need to consider the following situation when it comes to apt repository security. You will find your answer below.

You are adding an untrusted repository

Since anyone can create a private-public key pair, so just validating the downloaded contents or apt-index with the public key won't solve the problem when the author of the repository and the owner of the key puts malicious software in the repository.

He would create a key pair. Sign the contents with his private key, then upload the contents to the repository and then upload his public key

Then you add the repository, download his public key and then try to check. Apt would verify it without issuing warning messages. You might feel you are secure, but you are not. Are you sure you believe the person who has uploaded the content?

You added a repository which has content uploaded by a person you know

This might seem safe. You know the person's name and see that he has signed the repository contents and also the index. In this case too you are insecure. Anyone can impersonate the name.

In this case you need to verify the public key. You should be knowing that person's public key and should be sure about it. If you know the person and see that the repository needs a different public key for validating the contents then you should not trust that repository.

You should know the Person's name and his public key pair together to validate the authenticity of the repository. If any of them is wrong, don't trust the repository.

This is the reason why geek and hacker circles have key-signing parties where they meet in person, shoe each other valid identity proof and then establish trust

You know the person, have the correct public key, but apt shows warnings

This might be the case when you are trying to add the repository, but your computer is not getting the correct apt URL. This might be the situation where your DNS is not working properly and someone is trying to trick you into adding the wrong repository by DNS cache poisoning.

If you get a apt warning even when you have the correct public key, then ABORT. Don't go forward. This third case is usually very rare and you should not be worried about encountering this situation.


Conclusion

  1. When you want to add a repository and you want to be very sure you are adding the correct repository, you need to know the person who has uploaded the content and should be sure about his public key.

  2. Validate the repository only against his public key and not the one which repository owner asks you to verify against. This is the safest mechanism. As mentioned above, it is NOT safe even if apt doesn't give warnings when adding a repository. The contents might be malicious.

  3. Even if you are using a well known repository and then apt complains, then it means that you are not adding the correct repository. You are NOT SAFE.

share|improve this answer
    
So I'm mostly thinking about your third case. For example, say I'm trying to connect to the standard ubuntu servers to do security updates (i.e. security.ubuntu.com). To reduce bandwidth consumption, I'm going through a local apt-cacher proxy, but it's possible that someone may have tampered with the packages cached on that proxy server. Or there may even be a transparent apt proxy along the line somewhere. Will I get a warning if the packages are not the correct ones? How does updating my apt cache (sudp aptitude update) affect this? –  intuited Aug 9 '11 at 21:58
    
You can use a mirror. APT should not complain in this case if ALL the files in the repository are there and all the files are intact. AFAIK the repository index file is signed. Any changes to files on the repository would not match against the checksum. If the index file is tampered with, then apt would complain –  Manish Sinha Aug 9 '11 at 22:01
    
How does updating my apt cache affect this? It probably can. When you added that time your DNS cache might be poisoned. Now when you are trying it is probably pointing to correct IP. In this case updating apt cache would work –  Manish Sinha Aug 9 '11 at 22:08
    
So... if I'm using a proxy, then the update is coming from the proxy. So you're saying that the update index is signed, which guarantees it came from the actual ubuntu repository? –  intuited Aug 11 '11 at 11:39
    
@ntuited : Yes. If the proxy server is a clone of the actual repository then there isn't much problem. Apt would complain only when the contents are modified –  Manish Sinha Aug 11 '11 at 13:58
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.