0

My system fails to upgrade. I suspect it was breached. Is there a way to compare system configuration to default version that should be at this date and kernel version?

My current system is Debian, but I am interested if any Linux flavor supports this feature.

I want to see what packages should be there by default, what extra stuff (and why) is installed, what packages are not official or have incompatible versions. I also want to see what files outside /home are not from those packages. Anything that will give me a hint about difference of server config from its default normal version.

2

There was such a way, but you needed to have prepared for it already. (Kind of like how the fire insurance people won't sell you a new policy for a smoking hull.)

The two most common programs that do this are AIDE and Tripwire. They scan your system, build a database of what's there, and let you save that off to some durable storage medium off-machine, so that you can make comparisons later.

The closest you can come with on-machine resources on a Debian type Linux is to verify the package database via debsums. (RPM-based Linuxes can do the same, via rpm -qV.) Note the caveat at the end of that man page: You can't rely on these tools' output from a security perspective because a sufficiently clever and motivated attacker could have modified the databases to report that "Everything is fine." Also, the files this tool relies on are optional; not all packages will have them.

  • Is it possible to just bring up the image in LXC container and compare it? – anatoly techtonik Mar 19 '15 at 9:45
  • @techtonik: You can use that to detect modifications to system files, but it will do nothing to determine whether modifications to configuration files, data files, etc. are benign, malign, or accidental. Even then, for this to work, you're going to have to carefully set up the second container to match the first: same package set, same updates, etc. The very fact that the answer to this question matters to you tells you that the stock version of the Linux container is not interchangeable with your production instance. – Warren Young Mar 19 '15 at 10:02
0

Ok. Let me record how do I see it. Feel free to edit actual commands.

  1. Find out the exact version of your system (Ubuntu 15.10)
  2. Create remote container with the same system
  3. Update packages both for local machine and for remote
  4. Compare files on local and remote box recursively

The biggest problem is point 4 - how to compare local / with remote /?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.