0

Why Ubuntu accesses repositories via http, not https? Is it safe? Infested Wi-Fi router can easily replace an original .deb with a malware unless those .debs are encrypted and/or signed. Modern devices are powerful enough to perform DPI and provide fake .deb files/packets „on the fly“. Should I choose one of the few https mirrors in „Software Sources“?

3

Plain http is safe for apt to download debs from the Ubuntu repositories.

  • Debs ARE signed. They have been signed since Ubuntu started. They have been signed by Debian for years before that.

The apt+repository system is designed so that https is not required to ensure safe receipt of original debs from repositories. When the signature does not match the package for any reason, apt throws an error and won't install the package.

  • Man-In-The-Middle (MiTM) attacks were considered when the Debian distribution method was created, and that attack vector has been long mitigated using (increasingly long) signatures.

There is certainly nothing wrong with using https, if available. You are welcome to use https sources if you wish.

  • Most mirrors are contributed by volunteer organizations, not controlled by Ubuntu or by Canonical. Many serve content as 'archive.ubuntu.com'. That makes SSL/TLS certificate management --and the associated requirement for private key sharing-- a big ugly problem that no volunteer has stepped forward to solve in two decades of Debian-based distros. You are welcome to help solve it.

Naturally, if you can show a successful proof-of-concept MiTM attack against normal apt usage, the Ubuntu Security Team would love to know about your exploit so they can mitigate that.

4
  • "You are welcome to solve it" - yeah that can't be done without Debian and/or Ubuntu issuing the certs and then sharing it with all mirrors - official or unofficial - that serve for the 'archive.ubuntu.com' name - and then you get into a private key sharing problem that is a much larger security concern, and then it becomes a can of worms. Until HTTPS and TLS authentication change their fundamental operational methods for how certificates work (which is unlikely to happen in our lifetimes) there's almost no chance that problem can be 'solved'.
    – Thomas Ward
    Sep 20 at 2:49
  • @ThomasWard completely agree, and edited the mirror bullet. A big ugly problem. But who knows? Perhaps the OP is The Chosen One who can make it work.
    – user535733
    Sep 20 at 2:53
  • HTTP is useful for Squid-deb-proxy operation. Period.
    – N0rbert
    Sep 20 at 7:00
  • So, MiTM can provide a fake .deb file, but it'll be rejected by the system. HTTPS can provide additional encryption, and does not interfere with signatures. That's what I'd hoped to hear.
    – NickDoom
    Sep 20 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.