Re: Hash database
Raffaele D'Elia schrieb:
Unfortunatly not. I want to verify each file installed using .deb's
against the md5sum written inside the .deb itself.
Debsum does this storing the hashes locally. I want the same control
over a central db, independent from the machine I'm running debsums on.
There used to be a page http://www.nsrl.nist.gov/Downloads.htm (it seems
to be down, at least from my non-us place), but it's in the google
cache:
http://64.233.183.104/search?q=cache:6XVCDNiTBSMJ:www.nsrl.nist.gov/Downloads.htm+NIST+NSRL+%22RDS+2.8%22&hl=de.
There you can/could download the NIST NSRL (NIST National Software
Reference Library). These are hash databases which are used in
forensics. They get/buy a lot of software and establish a big hash
database of all these software. So if police takes your computer, they
use these hashes to put aside all the known good files (standard
software) and then check the rest for allowed/bad content. This cuts
down 50-95% of their work.
debian is probably in there, so this might be what you need.
There is another sites called http://knowngoods.org/ with a similar
purpose. I'm not sure if you can get the hashdb, maybe somewhere on
their site it is. There are other similar projects.
It would indeed be good if there were a debian database with all the
hashes of all published programs (all files: the .debs AND all their
contents, of simply everything). This would help to spot problems. You
could have a disk to boot from which collects all the hashes, and then
check these on another known good system with all the hashes. If then
"ls" or any other program had a bad hash, you know what you need to replace.
The disk could be a standalone mini-linux, which writes the hashes as
.gz on a (or more) disk(s), or send them over the network.
A complete hash database could also be put on a CD used to analyze the
system and tell all known OS files which don't have the expected hash.
For creating the hash database, it's only some script which looks at all
the debs and their content, checks ths md5s/sha1s, and compiles the info
at a single place. No rocket science.
Peer
Reply to: