1

Is everything okay?

$ sudo dpkg --verify
[sudo] password for *******: 
??5?????? c /etc/bash.bashrc
??5?????? c /etc/gdm3/custom.conf
??5?????? c /etc/sysctl.conf
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/btcoexist/btcoexist.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/rtl8188ee.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8192c/rtl8192c-common.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/rtl8192ce.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rtl8192cu.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8192de/rtl8192de.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/rtl8192ee.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rtl8192se.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/rtl8723ae.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8723be/rtl8723be.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8723com/rtl8723-common.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/rtl8821ae.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl_pci.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtl_usb.ko
??5??????   /lib/modules/4.15.0-46-generic/kernel/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
??5?????? c /etc/apparmor.d/usr.bin.webbrowser-app
??5?????? c /etc/X11/Xsession.d/99upstart
??5?????? c /etc/X11/Xsession.d/00upstart
??5?????? c /etc/xdg/autostart/print-applet.desktop
??5??????   /lib/firmware/rtlwifi/rtl8192eefw.bin
??5??????   /lib/firmware/rtlwifi/rtl8821aefw.bin
??5??????   /lib/firmware/rtlwifi/rtl8822befw.bin
??5??????   /usr/share/gnome-mahjongg/themes/postmodern.svg
1

From manpage of dpkg:

--verify [package name]

Verifies the integrity of package-name or all packages if omitted, by comparing information from the files installed by a package with the files metadata information stored in the dpkg database (since dpkg 1.17.2). The origin of the files metadata information in the database is the binary packages themselves. That metadata gets collected at package unpack time during the installation process.

Currently the only functional check performed is an md5sum verification of the file contents against the stored value in the files database. It will only get checked if the database contains the file md5sum. To check for any missing metadata in the database, the --audit command can be used.

Since you haven't provided any package name, it will check all files' md5sum against the values stored in file database. This might take a very long time. So, its better to run it with some specific package name at a time.

The output here is because of some errors.

  • ? indicated that file can't be checked because of permissions
  • c denoted that this is a configuration file
  • 5 means verification failed
| improve this answer | |
  • Does ??5?????? indicates some harmful packages (malware or something)? – Huxoor Mar 23 '19 at 7:33
  • @Huxoor Nope. I've already explained what they mean in my answer. (See last bullet points) – Kulfy Mar 23 '19 at 7:35
  • Thanks a lot, man. I will be very thankful if you help me with this one askubuntu.com/questions/1128001/… – Huxoor Mar 23 '19 at 7:39
  • @Huxoor Your other question is based on Cyber Security. IMO you should look for any unusual behaviour on the system. As you pointed out, since you are an intense user there might be other factors due to which your system is lagging. Attacks on Linux are very rare. Viruses are injected when you run some suspicious piece of software or download malicious file. – Kulfy Mar 23 '19 at 7:52
0

sudo dkpg --verify will check integrity of your installed files. When you run this command, you will see, which files were changed after install. These are typically configuration files. Take a look at the changed files and check if they are OK.

I regularly use RPM's commands rpm -Va and rpm -qa, which do similar checking on some servers that are connected to internet. In this way, I monitor if any files would be changed from outside, or if any new packets have been installed, which would mean security breach or uninvited guests on my servers. Of course, this checks are not enough, but are one step of protection, that can be done. The verify commnad might take a while, but in my experience it is not so long - a few minutes.

| improve this answer | |
  • Does ??5?????? indicates some harmful packages (malware or something)? – Huxoor Mar 23 '19 at 7:34
  • Probably not. It just means that the file has been changed. In your case you have some wifi kernel modules changed, which you probably installed from other source. If you have programs changed like /bin/ps or /bin/ls, would be suspicios, because an attacker might change these to hide her/his presence. There will always be some files changed. It is just nice to know why they have been changed and by whom. – nobody Mar 23 '19 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.