{"id":11337,"date":"2012-03-18T18:44:31","date_gmt":"2012-03-18T17:44:31","guid":{"rendered":"https:\/\/www.saasweb.agency\/blog\/how-can-you-easily-verify-the-integrity-of-installed-files-on-a-debian-system\/"},"modified":"2026-10-27T08:20:55","modified_gmt":"2026-10-27T07:20:55","slug":"how-can-you-easily-verify-the-integrity-of-installed-files-on-a-debian-system","status":"publish","type":"post","link":"https:\/\/www.saasweb.agency\/en\/blog\/how-can-you-easily-verify-the-integrity-of-installed-files-on-a-debian-system\/","title":{"rendered":"How can you easily verify the integrity of installed files on a Debian system?"},"content":{"rendered":"

\"\"<\/a><\/p>\n

When using monitoring tools such as tripwire<\/em> or rkhunter<\/em> to monitor changes to installed files, the problem is that these tools cannot detect whether the files were changed by a regular package upgrade or tampered with by an unauthorized person.<\/p>\n

For example, if rkhunter<\/em> reports that the file \/usr\/bin\/ldd<\/em> has been modified, you must manually check whether the file’s checksum corresponds to the latest version of the Debian package.<\/p>\n

There is a tool called debsums<\/strong> that simplifies this task. It can be installed using: <\/p>\n

# apt-get install debsums<\/div>\n

Once the tool is installed, you can perform the check at the package level:<\/p>\n

# debsums file
\n\/usr\/bin\/file OK
\n\/usr\/share\/bug\/file\/control OK
\n\/usr\/share\/bug\/file\/presubj OK
\n\/usr\/share\/doc\/file\/README.Debian OK
\n\/usr\/share\/doc\/file\/README.gz OK
\n\/usr\/share\/doc\/file\/changelog.Debian.gz OK
\n\/usr\/share\/doc\/file\/changelog.gz OK
\n\/usr\/share\/doc\/file\/copyright OK
\n\/usr\/share\/lintian\/overrides\/file OK
\n\/usr\/share\/man\/man1\/file.1.gz OK<\/div>\n

but not at the file level:<\/p>\n

# debsums \/usr\/bin\/ldd
\ndebsums: invalid package name ‘\/usr\/bin\/ldd’<\/div>\n

First, you need to find out which package the file \/usr\/bin\/ldd belongs to.<\/p>\n

# dpkg -S \/usr\/bin\/ldd
\nlibc-bin: \/usr\/bin\/ldd<\/div>\n

To avoid having to run the search every time, I have written a small shell script that handles this task and calls debsums with the results:<\/p>\n

#!\/bin\/bash
\nEC=0
\nPKGS=$(dpkg -S “$@” | awk -F’:’ ‘{print $1}’ | sed -e ‘s\/, \/\\n\/g’ | sort | uniq)
\nfor i in $PKGS; do
\ndebsums “$i” | grep -v OK
\ndec=$PIPESTATUS
\necho -n “=== Package ‘$i’ : ”
\nif [ $dec -eq 0 ]; then echo OK; else echo MODIFIED; EC=$dec; fi
\ndone
\nexit $EC<\/div>\n

In this example, I have named the script check-inst.sh. It is easy to use: <\/p>\n

# .\/check-inst.sh \/usr\/bin\/ldd
\n=== Package ‘libc-bin’ : OK<\/div>\n

You can call the script with multiple filenames:<\/p>\n

# .\/check-inst.sh \/usr\/bin\/file \/usr\/bin\/ldd
\n=== Package ‘file’ : OK
\n=== Package ‘libc-bin’ : OK<\/div>\n

If you do not use an absolute path, you will get search results for installed packages:<\/p>\n

# .\/check-inst.sh apache2
\n=== Package ‘apache2’ : OK
\n=== Package ‘apache2.2-bin’ : OK
\n=== Package ‘apache2.2-common’ : OK
\n=== Package ‘apache2-doc’ : OK
\n=== Package ‘apache2-mpm-prefork’ : OK
\n=== Package ‘apache2-suexec’ : OK
\n=== Package ‘apache2-utils’ : OK
\n=== Package ‘bash-completion’ : OK
\n=== Package ‘libapache2-mod-fcgid’ : OK
\n=== Package ‘libapache2-mod-php5’ : OK
\n=== Package ‘libapache2-mod-ruby’ : OK
\n=== Package ‘libapache2-mod-suphp’ : OK<\/div>\n

If the results are OK, you can update your monitoring tool with peace of mind. For example, with rkhunter: <\/p>\n

# rkhunter –propupd –update<\/div>\n

Here is an example output showing the files modified by the user:<\/p>\n

# .\/check-inst.sh \/usr\/bin\/pear
\n\/usr\/bin\/pear FAILED
\n\/usr\/bin\/peardev FAILED
\n\/usr\/bin\/pecl FAILED
\n…
\n\/usr\/share\/php\/pearcmd.php FAILED
\n\/usr\/share\/php\/peclcmd.php FAILED
\n=== Package ‘php-pear’ : MODIFIED<\/div>\n

The script returns ExitCode 0<\/strong> if all checks were successful; otherwise, it returns the error code of the first failed check. This is useful if you are initially only interested in the exit code and want to read the error results from a log file. <\/p>\n

Have fun trying it out!
\nC.<\/p>\n","protected":false},"excerpt":{"rendered":"

When using monitoring tools such as tripwire or rkhunter to monitor changes to installed files, the problem is that these tools cannot detect whether the files were changed by a regular package upgrade or tampered with by an unauthorized person. For example, if rkhunter reports that the file \/usr\/bin\/ldd has been modified, you must manually \u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[981,983],"tags":[988,1112,960,1153,1930,1010,1078,1062,982,1001,1028],"class_list":["post-11337","post","type-post","status-publish","format-standard","hentry","category-programming","category-tutorial","tag-administration","tag-checksum","tag-debian","tag-debsums","tag-dpkg","tag-integrity","tag-monitoring","tag-monitoring-tool","tag-package-management","tag-rkhunter","tag-tripwire"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/posts\/11337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/comments?post=11337"}],"version-history":[{"count":0,"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/posts\/11337\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/media?parent=11337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/categories?post=11337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.saasweb.agency\/en\/wp-json\/wp\/v2\/tags?post=11337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}