5

I am planning to run a production server on Ubuntu LTS 8.04 and I am concerned about security of the packages I am installing I want to make sure that packages that are downloaded by apt-get were not tampered with.

  1. How do I view the digital signatures associated with a package in ubuntu?
  2. Does apt-get install, apt-get update, apt-get upgrade automatically check digital signatures when downloading, installing packages or do I need to pass a command line option for these checks to happen?
  3. Who am I trusting when I install a package using apt-get install assuming that the package is part of the ubuntu main distribution, am I trusting canonical, debian, or an open source contributor?
4
  • 2
    I have not a so deep knowledge of the problem, but I think that the apt-secure manual page can answer most of your questions.
    – enzotib
    Dec 29, 2011 at 10:54
  • As has been suggested, see help.ubuntu.com/community/SecureApt In the "good old days" sys admin would review the source code before installing on a server, but frankly the volume of code is too large. If you do not trust the developers, microsoft or ubuntu or debian, then yes you would need to learn to review the source code. Either you trust others to do it for you, or you review it yourself ;)
    – Panther
    Dec 29, 2011 at 16:53
  • Off-topic: I'd use ubuntu 10.04 as a production server, due to release end-of-life: wiki.ubuntu.com/Releases#Stable Dec 29, 2011 at 17:26
  • 1
    As an addition to the above comments, here's how you list the keys that apt trusts: sudo apt-key list - You can also add/delete/update keys using the apt-key command (e.g. sudo apt-key update; sudo apt-key net-update) Dec 29, 2011 at 17:32

1 Answer 1

3

You are trusting that canonical compiled the program so it did not have any tampering that is not evident in the source code, and that they verified the signature on the source code from the ubuntu developer that uploaded it, or that debian did the same for the debian developer who uploaded it, if the package came from debian. You are trusting the developer who uploaded the source package, who of course, can not thoroughly review all of the upstream code, so you are also trusting all of the upstream open source contributors.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .