Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am planning to run a production server on Ubuntu LTS 8.04 and I am concerned about security of the packages I am installing I want to make sure that packages that are downloaded by apt-get were not tampered with.

  1. How do I view the digital signatures associated with a package in ubuntu?
  2. Does apt-get install, apt-get update, apt-get upgrade automatically check digital signatures when downloading, installing packages or do I need to pass a command line option for these checks to happen?
  3. Who am I trusting when I install a package using apt-get install assuming that the package is part of the ubuntu main distribution, am I trusting canonical, debian, or an open source contributor?
share|improve this question
1  
I have not a so deep knowledge of the problem, but I think that the apt-secure manual page can answer most of your questions. –  enzotib Dec 29 '11 at 10:54
    
As has been suggested, see help.ubuntu.com/community/SecureApt In the "good old days" sys admin would review the source code before installing on a server, but frankly the volume of code is too large. If you do not trust the developers, microsoft or ubuntu or debian, then yes you would need to learn to review the source code. Either you trust others to do it for you, or you review it yourself ;) –  bodhi.zazen Dec 29 '11 at 16:53
    
Off-topic: I'd use ubuntu 10.04 as a production server, due to release end-of-life: wiki.ubuntu.com/Releases#Stable –  medigeek Dec 29 '11 at 17:26
    
As an addition to the above comments, here's how you list the keys that apt trusts: sudo apt-key list - You can also add/delete/update keys using the apt-key command (e.g. sudo apt-key update; sudo apt-key net-update) –  medigeek Dec 29 '11 at 17:32
add comment

1 Answer

up vote 2 down vote accepted

You are trusting that canonical compiled the program so it did not have any tampering that is not evident in the source code, and that they verified the signature on the source code from the ubuntu developer that uploaded it, or that debian did the same for the debian developer who uploaded it, if the package came from debian. You are trusting the developer who uploaded the source package, who of course, can not thoroughly review all of the upstream code, so you are also trusting all of the upstream open source contributors.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.