6

Neither the ISO nor the hashsum is available via HTTPS. Is there any way to verify you're not getting man-in-the-middled?

Improve this question
5
  • If you want any help - please make sure your question is clear and understandable. What exactly you are trying to do?
    – Ashu
    Feb 29, 2016 at 21:53
  • 1
    @Ashu I'm trying to install a verified ubuntu iso. Using a hashsum from the same server via http is almost pointless.
    – Ryne Everett
    Feb 29, 2016 at 21:56
  • shop.canonical.com/index.php?cPath=17
    – Panther
    Feb 29, 2016 at 23:33
  • Why do you assume https is safe? :-)
    – Rinzwind
    Mar 2, 2016 at 18:52
  • 1
    @Rinzwind I hope I haven't given that impression. But unlike http, I assume https is safe from your average teenager.
    – Ryne Everett
    Mar 2, 2016 at 19:26

3 Answers 3

Reset to default
5

The hashes and iso's are only provided via http, so md5sum-checking is insufficient. As @Doug Smythies explained in a comment on a deleted answer:

We (the Ubuntu Doc team) no longer maintain the https page, because it is pretty much impossible to do so. The people with the ability to do an https page won't.

However, Ubuntu's gpg fingerprints are available via https here.

TLDR

  1. Download MD5SUMS and MD5SUMS.gpg for the relevant release.
  2. Verify the MD5SUMS with the MD5SUMS.gpg and check that the fingerprint is the same as on this web page.
  3. Verify the iso with the MD5SUMS.
Improve this answer
2
3

Whilst Canonical isn't providing HTTPS some of the officially recognized 3rd-party mirrors do, so that may be a viable alternative. Even without HTTPS you can always compare the checksums provided by several different mirrors (that you recognize) to help decrease the odds of a MITM (Man In The Middle).

List of Official 3rd-Party Mirrors CAPABLE of HTTPS:

(remove the - from h-ttps, only put there because too many urls)

In future, for those whom don't fancy checking mirrors by hand for HTTPS, you can use Https Finder, which was the tool used to find these mirrors.

Improve this answer
0

You can download your favorite ubuntu from here: http://www.ubuntu.com/download/desktop

and you can see the md5 checksum from here: http://releases.ubuntu.com/14.04/

Infact 2nd link contains all the .iso and the md5 checksums.

Look for this link for verifying the .iso file

I will suggest go for Ubuntu desktop 14.04 LTS(Long term support).

Improve this answer
9
  • 2
    Both of those files are only provided via insecure http. How can I verify that they aren't both from the same man-in-the-middle?
    – Ryne Everett
    Feb 29, 2016 at 22:24
  • So the only way to get the public gpg key used to sign releases is to install ubuntu?
    – Ryne Everett
    Feb 29, 2016 at 23:13
  • @bodhi.zazen it didn't answer the question at the time I wrote the comment. Since then, ubfan1 added a link to a possible duplicate which Ashu adopted in his answer.
    – danzel
    Feb 29, 2016 at 23:19
  • @RyneEverett - no, the public gpg keys are available on key servers. See help.ubuntu.com/community/Repositories/… . You should be able to identify and download the ubuntu gpg keys if you know how to use gpg, if not, well that is a separate question.
    – Panther
    Feb 29, 2016 at 23:24
  • @RyneEverett. If you are downloading .iso from Windows(which most of the folks might be doing)-there is a utility in Windows 10(microsoft.com/en-us/download/details.aspx?id=11533). Having said that you don't have to install ubuntu to verify md5 checksum
    – Ashu
    Feb 29, 2016 at 23:25

Not the answer you're looking for? Browse other questions tagged .