- Security of Deb and Other Files
You can find a .deb file for a package somewhere on the Internet. Then you can use dpkg -i package.deb
and install it. That's no better than picking up an install for Windows somewhere on the Internet. Don't do it unless you are absolutely sure of the source, and even then make sure you have all of the prerequisite packages already installed.
Deb files, safe or not, do follow a format with hashes, etc. so that they have to be rebuilt if they are changed.
Package (.deb files) in the Ubuntu repositores are generally built from source on Launchpad build computers so the contents of the .deb file matches the source, and the source can be viewed by anyone. Many packages have teams maintaining them who follow them and are on the lookout for security problems. New source package versions have to be signed properly by gpg keys using public key cryptography before they can be built.
There are now binary only packages available in the Ubuntu Software Center, so the public can't view the source of those. I don't know about these for sure, but I believe they are reviewed before they are made available.
You generally shouldn't install a package with dpkg -i package.deb
, but use apt-get or the software center instead, downloading from an Ubuntu repository. You should also avoid picking up any other kind of script that you can't look at and understand completely before you run it.
The multi-user system Unix-like systems do mean that if you make a mistake you can mess up your account and its files, but not the accounts and settings of other users that have been established on the same system, nor the operating system itself.
The exception is when you run a command with sudo
or have to enter a password to install a package or do other maintenance. These are the times to be very careful about the source of what you are doing. This is very similar to using UAC.
- Executable Files on Removable Media
As long as you are using due care, I don't think you need to maintain programs on removable media. Like Windows, most programs are installed as packages and therefore aren't runnable from removable media (although you could put an entire Ubuntu on a flash drive if you want).
As I mentioned above, .deb files use hashes for the files they include to see that they aren't altered by an attacker. Ubuntu repositories also have gpg keys stored on your system when you install Ubuntu, and there is a signature and chain of hashes followed down to the .deb files to keep things secure. Ubuntu is derived from Debian and that project created this approach.
There are things like autorun in Linux and other Unix-like systems. When you install packages those packages can cause programs to start at boot time, or when a user logs in to a terminal, or when a user logs into a GUI session. Most users have a (hidden by default) .bashrc file in their home directories that execute when a user logs in to a terminal.
The Ubuntu download web site not only has the .iso files for CD's and DVD's but also message digests (hashes) you can check to make sure the file you retrieved is authentic down to the bit.
Despite everything else, developers make mistakes and potential security problems can creep into software. Running supported versions of Ubuntu means that you will be offered security fixes for items in the main Ubuntu repositories, and often for items in the universe and other repositories. You should apply those fixes. Long-term-support releases like 12.04 (Precise) offer this service for a longer term than other releases of Ubuntu.
I can't personally guarantee that the precautions are perfect, but I think they are pretty good for the current state of the art.
Ubuntu publishes a manifest that is signed with an RSA key. The manifest lists individual Packages
index files, each with MD5, SHA-1 and SHA-256 hashes. Each Packages
file lists individual .deb
files with MD5, SHA-1 and SHA-256 hashes.
For verification, apt uses the best hash that it supports and is published by the archive it is downloading from. In the case of the Ubuntu archive, this is SHA-256.
So the entire chain of installing packages on your Ubuntu system is protected by RSA and SHA-256.
The MD5 protection that exists in dpkg is really only useful for accidental corruption, and not necessary to protect the installation path.
You might be interested in the debsums
package, but since it uses MD5s, it also is only useful for checking for accidental corruption.
If you want to check for malicious system modification, then these are not the appropriate tools for you. You will need to take the system offline and check against either a previous record, the original package files, or secure hashes generated from these.
Note that since a successful malicious modification might be to simply downgrade a package to the one prior to a security update, checking that all installed package files match against their originals may not be sufficient either.
Best Answer
The only way to ensure that a PPA is "safe": Download the source packages published in that repository and check the source code contained in these source packages. Also, before installing updates on your machine, you would have to re-check the PPA to see if a new source package has been uploaded and audit that new source code.
Obviously, most users are unable to do that because they lack the skills required for a security audit. And it would be very time-consuming.
If you installed at least one package from that PPA (either through apt-get install, or apt-get upgrade), it is theoretically possible that your system is now infected, even after you apt-get removed that package. Packages are installed using root (administrator) privileges, so they can harm your system in any conceivable way. Usually, the packages are not harmful though. As far as I know, nobody attempted to infect Ubuntu systems through PPAs yet.
After doing add-apt-repository, you should remove the PPA if you no longer want it. If it contains malicious packages, this is however not a safe way to revert to a clean state. How can PPAs be removed?
If we assume that there was a malicious package installed on your system, the only way to be sure to get rid of an infection is to re-install the system completely, or revert to an older backup of your system.