Ask the package database four questions

short · 20 min · Objective 2.4

Task

Use the package manager as a forensic tool rather than an installer: find which package owns a file, what a package installed, whether anything has been modified since installation, and where an installed package actually came from. These are the queries that answer "what is this file and should it be here?".

Steps

  1. Find which package owns the SSH daemon binary. rpm -qf /usr/sbin/sshd on the Red Hat side, dpkg -S /usr/sbin/sshd on the Debian side.
  2. List everything that package installed, and count the files: rpm -ql openssh-server or dpkg -L openssh-server.
  3. Verify the installed files against the package's own manifest with rpm -V openssh-server, or debsums openssh-server where available. Read the output codes -- a 5 means the checksum differs, T means the timestamp does.
  4. Deliberately modify a configuration file belonging to a package, re-run the verification, and confirm it is now reported.
  5. Find which repository an installed package came from: dnf repoquery --installed --qf '%{name} %{from_repo}' openssh-server, or apt-cache policy openssh-server.
  6. List the enabled repositories and note whether any are third-party.

Verify

# Red Hat family
rpm -qf /usr/sbin/sshd
rpm -ql openssh-server | wc -l
rpm -V openssh-server                      # empty output means unmodified
# after modifying /etc/ssh/sshd_config:
rpm -V openssh-server | grep -q '^S\.5' && echo "modification detected"

The third command producing no output is the healthy case, and the fourth must print after step 4. If verification reports nothing after you have edited a file, you edited something the package does not own -- check with rpm -qf.

Notes

Step 3 is the one worth carrying into security work. A changed configuration file is normal and expected -- administrators edit them. A changed BINARY was not changed by anybody's legitimate workflow, and is a finding rather than a note.