1

My goal is to set up an Ubuntu Server installation via debootstrap from another Ubuntu installation and to be sure that this new installation is a correct Ubuntu installation without modifications. When I execute

debootstrap trusty /mnt http://de.archive.ubuntu.com/ubuntu

I get the response

 Valid Release signature (key id 790BC7277767219C42C86F933B4FE6ACC0B21F32)

But how does this release signature is checked? Against what other key? Or to ask in a different kind: How can I be sure that the downloaded package for debootstrap is valid and was not modified on its way?

|improve this question
0

The validity of the packages is checked against a keyring which can be explicitly specified with the --keyring=KEYRING option of debootstrap (see man debootstrap for details).

If omitted debootstrap uses system keyrings which you can easily install with [name]-keyring packages in synaptic/apt-get and (only slightly more complicated) from source.

If debootstrap tells you that the package is valid there's a high change that it is. If you mistrust debootstrap or a library which it uses for the validation, you need to perform a sophisticated security review based on the source code.

|improve this answer
  • So if I omit the --keyring option, Ubuntu will use the system keyring from /usr/share/keyrings/ubuntu-master-keyring.gpg? How can I verify this key, is there another site to download it from (maybe with SSL-encryption), to compare it with the one provided by apt-get? – Chessmaster Apr 26 '15 at 16:56
  • It must have been installed either during installation of Ubuntu (like ubuntu-keyring) which can be verified in the boot menu of the live distribution or is is installed with apt-get which verifies packages (including the -keyring packages) with PGP. – Karl Richter Apr 26 '15 at 16:59
  • It has been installed during installation of Ubuntu, but this installation was done by the hoster of the server, which I don't trust. So I'm searching for a way to verify this key... – Chessmaster Apr 26 '15 at 17:07
  • I see. Sounds like a tricky scenario. Maybe you'll get more input if you ask/search for existing answers for a more abstract question, like "How to verify a PGP key on an untrusted system?". I'm pretty sure that you have to do it outside the system, e.g. in a live system, which is definitely out of the scope of debootstrap. – Karl Richter Apr 26 '15 at 17:14
  • That sounds like a good idea, I'll try that. Thanks for your input! – Chessmaster Apr 26 '15 at 17:30
0

If someone searches for more details: I solved my problem with the fingerprints of the keyfiles (you can get them with apt-key finger) and compared them with other (secure) systems.

Maybe helpful is this thread: How do I know my system updates are trustworthy?

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.