Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm aware of md5sum and gpg but I have no idea if there are recorded checksums for whatever current version of ubuntu is installed.

Do these get recorded somewhere? Specifically I'm suspicious that my /bin/ps executable has been compromised by a hacker.

Thanks

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Most Linux distributions are based on a binary package format. In this case, find out what package a program came in, and either just reinstall it, or download the package and compare.

ps is part of procps, and its Ubuntu packages available here. ps has the MD5 checksum d9a2e1562e6aabb8f02b43f8b6e3d7eb in its current release for "Raring Ringtail" for amd64.

share|improve this answer

Most package systems have a way to check the integrity of installed packages.

For RPM based systems : rpm -V <packagename>

For Debian / Ubuntu you can use debsums :

debsums - check the MD5 sums of installed Debian packages

This is mostly useful to find accidental corruptions. If you suspect malicious modification, tools like rkhunter or chkrootkit may be useful.

Don't forget that once a system has been compromised you can't trust it any more.

share|improve this answer
1  
+1, also: "you can't trust it any more" includes any positive verification results of system binaries performed on this system. –  Daniel Beck May 10 '13 at 13:02
    
Good point. Dynamic libs could be tinkered with and then md5sum would not show anything. We ended up wiping the system because the break-in appeared to be a pretty sophisticated attack. –  marathon May 15 '13 at 19:14

I dont know if there is a list of md5 hashes...

However, you can always recompile ps from source and compare the md5 hashes of both.

share|improve this answer
3  
As far as I know, the md5 will with a very high likely hood differ due to differences between the systems (different versions of gcc/g++, different configurations, possible difference in patch levels of the sources etc.). In theory it is a good idea, in practice it is easier to use the package manager to verify the integrity. –  Bobby May 10 '13 at 6:57
1  
oh yeah... good point, didnt think about that –  Keltari May 10 '13 at 12:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.