7.5.3. Detecting Changes
Once a system is installed and configured, most system files should stay relatively static until
the system is upgraded. Therefore, it is a good idea to monitor changes in system files since any
unexpected change could be cause for alarm and should be investigated. This section presents a
few of the most common tools used to monitor system files, detect changes, and optionally notify
you as the administrator of the system.
Auditing Packages with
dpkg --verify
dpkg --verify
(or
dpkg -V
) is an interesting tool since it displays the system files that have
been modified (potentially by an attacker), but this output should be taken with a grain of salt. To
do its job,
dpkg
relies on checksums stored in its own database which is stored on the hard disk
(found in
/var/lib/dpkg/info/
package
.md5sums
). A thorough attacker will therefore modify
these files so they contain the new checksums for the subverted files, or an advanced attacker
will compromise the package on your Debian mirror. To protect against this class of attack, use
APT’s digital signature verification system (see section
8.3.6
, “
Validating Package Authenticity
”
[page 208]) to properly verify the packages.
