Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.

From time to time I want to boot from a clean boot CD and check if the system has been compromised.

For that reason, I want to check if any packages / binaries have been modified, check the bootloader, check for rootkits.

Let's suppose I booted from a clean boot CD and mounted the hdd filesystem.

How can I get list of all sha256 hash sums of all installed binaries and configuration files and check them against the versions from Debian repository?

I have looked into intrusion detection systems (debsums,) Afick, AIDE, FCheck, Integrit, Osiris, OSSEC, Samhain, Tripwire, but they all have in common, that they want to create a known-good database before auditing. This doesn't scale very well, because updates are pretty frequent, which render that known-good database less useful. Re-creating the known-good database after updating isn't very safe either - let's say apt-get had a bug and installed a malicious package, then the checksum of that malicious package would end up in the known-good database.

I think the real solution is checking against the distribution's package repository. How can I do that?

share|improve this question
add comment

1 Answer

Have a look at SecureApt they check updates on checksums and also on pgp keys you give your trust to.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.