24

My current location is thousands of kilometers from Ubuntu's main server and I am obliged to use one of its mirrors in my country of domicile.

Do the owners of Ubuntu implement measures to periodically check their files (eg. ISOs, updates, security patches) at their mirror sites have not been tampered and/or malware/trojans have not been introduced by hackers?

My personal experience with installing and updating Ubuntu from the main server took at least two hours whereas the same process took just 10 to 15 minutes when I used Ubuntu mirror site available in my country.

7
  • 11
    @ the down-voters: plz explain why you down-voted in a short comment; if anything I'd consider this question at least an effort to express a legitimate concern. If you have grounds to believe one needn't be worried about it, plz explain why. Thank you. Mar 26, 2013 at 17:39
  • 9
    Close voter(s): This is not off-topic. It could benefit from some refinement--essentially nothing in the world is hacker- and tamper-proof, after all. But a question asking what security measures are taken by the Ubuntu project to monitor the security of mirrors that are maintained by others--which is what this is asking--is a good one (both in general, and for our site in accordance with the FAQ). Mar 26, 2013 at 17:40
  • I've retitled it a bit to be more general which should address the points in the question. Mar 26, 2013 at 17:42
  • 1
    Related reading: askubuntu.com/questions/56509/…
    – user25656
    Mar 26, 2013 at 17:47
  • 2
    For ISOs, I think you may do MD5 hash check on the ISO downloaded from the mirror against the MD5 obtained from the parent. Since it is the same ISO, it should have the same MD5 as in parent site.
    – Ahmadgeo
    Mar 26, 2013 at 17:52

1 Answer 1

18

Packages in the Ubuntu archive are signed with a GPG key, which anyone attempting to replace code on the mirror, doesn't necessarily have. It would be possible to forge a signed package, but it's not super trivial to do so.

You can generally trust the packages signed with these GPG keys. When updating through update-manager or apt you will be warned when packages are not signed with a key that is in the system apt package keyring. You will have to manually accept installation of such packages. If you see this warning for a package coming from the official Ubuntu archive, or a mirror thereof, you should probably not install the package, and immediately report a bug about it.

For ISOs, you will need to verify the checksum hashes with what's on the official Ubuntu servers.

11
  • 1
    @ dobey: Thanks for the info. It would be good if The Ubuntu Project provides an updated list of trusted mirrors; in particular I wish to find out if the mirrors in my country of domicile have been certified as trusted by The Ubuntu Project.
    – n00b
    Mar 27, 2013 at 1:15
  • 1
    If you care about security/stability, you should probably not add PPAs. The packages in them are signed, but there are no real guarantees with them, in general.
    – dobey
    Mar 27, 2013 at 1:46
  • 1
    I don't know if the mirror servers verify the GPG signatures and checksums of the packages or not. The locally run software on your system does check the GPG signatures though.
    – dobey
    Mar 27, 2013 at 15:09
  • 1
    you should probably not install the package, and immediately report a bug about it. I think running apt-get update, try again then report a bug is a better approach. Sometimes if the connection breaks during an apt-get update you will get the same warning as well if you try to install a package before updating again.
    – Dan
    Mar 27, 2013 at 15:15
  • 1
    @Dan the warnings at that time is during package information update, not install of packages. This is about installation of packages.
    – dobey
    Mar 27, 2013 at 15:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .