Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 10 down vote favorite

Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure way.

I'm especially thinking about attack vectors like man-in-middle and problems like breach of security on both the repository meta server and the repository file mirrors.

I have heard that both Slackware and Arch linux are very vulnerable because they lack package signing. Is this true? Are there any other major linux distro's that are vulnerable for simple man-in-middle attacks?

share|improve this question

6 Answers

up vote 5 down vote accepted

This isn't a direct answer to your question, but there are several things you can do to mitigate against this risk. The simplest one is to check your downloaded packages against the checksums from a different mirror than you downloaded from.

When my package manager (poldek) downloads a package, I have it set to keep a copy of the downloaded rpm in a cache folder. It automatically checks the checksum of the download against the package repository and warns/aborts on a mismatch, but if you were worried about man-in-the-middle attacked against your distro repository it would be easy to write a secondary script that browsed through all your downloaded packages and verify them against checksums you download from a different mirror. You can even run your first install as a dry-run so that packages get downloaded but not installed, then run your verification script, then do the actual install.

This doesn't stop a compromised package from getting into the distro's repository, but most distros have other ways of mitigating that, and even signed packages would not guarantee this was never a problem. What it does do is stifle the targeted man-in-the-middle attack vector. By using a separate source and downloading on a separate channel, you kill the ease with which a compromised package could be dropped into a tapped line.

share|improve this answer
1  
There is a package for Arch called paccheck that does this, compares packages against different mirrors before installation and warns of any discrepancies. – Wolf Jul 8 '11 at 12:00
up vote 8 down vote

Debian packages are checksummed, and the checksums are signed by a key in the Debian keyring. The apt package manager ensures that the downloaded package has the correct checksum and that the checksum file was signed correctly.

share|improve this answer
up vote 4 down vote

Fedora packages are signed and checksummed. Even 3rd party repositories such as rpmfusion sign their packages.

Yum (the package manager) requires a special flag (--nogpgcheck) to install packages which haven't been signed.

share|improve this answer
and so does downsteam packages i.e. Red Hat and CentOS – fpmurphy Jul 9 '11 at 14:35
up vote 2 down vote

All Arch Linux packages use an md5 or sha1 sum to check that all the bits are in place. It's up to the package maintainer to choose the hashing algorithm. Packages installed from AUR (often just a small PKGBUILD text file) are supposed to be checked by the installee before being installed. The repositories containing the official binary packages are supervised by trusted users (TUs).

Update: Arch has now introduced package signing with pacman 4

share|improve this answer
2  
All true, but packages are not signed and therefore remain vulnerable to mitm and mirror compromise attacks, however remote the possibility. It's been a long-requested feature and the main reason why I grudgingly stopped using Arch. That said, there is ongoing discussion about it in Arch and Pacman forums and wiki - it's a difficult problem to solve. Apart from this issue, Arch is a fantastic distro. – Eli Heady Jul 8 '11 at 0:28
@Eli: I'm not debating the truth of this - I have no idea of the state of affairs - but wouldn't it be a vanishingly slim market to attack. Granted, Arch is quite a popular distro, but aren't all these types of mischief generally predicated upon being able to make a buck? – boehj Jul 8 '11 at 0:39
1  
Sure, after all this is the reason the Windows userbase is targeted more than that of Linux, right? The thing is, what applies to the aggregate usually does not exactly apply to the individual. What I mean is everyone's threat model is different - if you have reason to fear being singled out for an attack, you should take appropriate steps to diminish the risk. Lack of package signing presents attack vectors that are not all that hard to exploit. If you have valuable bits to protect, this issue should be taken into account in your threat mitigation strategy. – Eli Heady Jul 8 '11 at 1:10
You could install Arch from a CD/DVD and then just take care to check that the md5/sha1 sums of the binary packages correspond to the sums from several mirrors before installing, similar to what Caleb suggested. There's never 100% security in any case, even though I do see the point of package signing, and wish that Arch had it. – Alexander Jul 8 '11 at 12:37
up vote 1 down vote

Who said Slackware has no package signing?

Slackware packages are signed with a public key of Slackware. So every package has its signature with extension .asc. Not only the packages but other files are also signed, like CHECKSUMS.MD5. This contains list of checksums of the packages.

The distro has an official tool called slackpkg for downloading/installing packages from a mirror. After updating the local repo database with slackpkg update the tool checks the signature validity of the new MD5 file and changelog, etc...

After downloading a package (but before installing) the signature and MD5 of the package are checked.

One can obtain the public key with slackpkg update gpg or simply importing it from the install CD with gpg --import GPG-KEY

There's an other unofficial tool slapt-get for Slackware. It supports GPG-checks too! In a similar way as slackpkg.

share|improve this answer
up vote -2 down vote

OpenBSD by and far. The entire project is dedicated around security, the team even put up a 5000+ line patch to the original apache because they didn't feel it was secure enough to be used. This is via pkg_add but I've never had issues with it.

share|improve this answer
4  
You're not answering the question: it's specifically about verifying signatures of downloaded packages (and ports, in the case of *BSD). – Gilles Jul 9 '11 at 12:30
I agree with @Gilles; OpenBSD is a great OS, but @grm asked about Linux package distribution security. – livingstaccato Feb 3 at 19:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.