Skip to content

debsums

debsums

ave you ever wondered why a given binary or package installed on your system does not work according to you expectations, meaning it does not function correctly as it is supposed to do, perhaps it can not event start at all.

While downloading packages, you may face challenges of unsteady network connections or unexpected power blackouts, this can result into installation of corrupted package.

Considering this as an important factor in maintaining uncorrupted packages on your system, it is therefore a vital step to verify the files on the file system against the information stored in the package by using following article.

On Debian/Ubuntu systems, you can use the debsums tool to check the MD5 sums of installed packages. If you want to know the information about debsums package before installing it, you can use APT-CACHE like so:

apt-cache search debsums

Next, install it using apt command as follows: 

sudo apt install debsums

Now its time to learn how to use debsums tool to verify MD5sum of installed packages.

In addition, the output from the debsums command shows you the file location on the left and the check results on the right. There are three possible results you can get, they include:

  • OK – indicates that a file’s MD5 sum is good.
  • FAILED – shows that a file’s MD5 sum does not match.
  • REPLACED – means that the specific file has been replaced by a file from another package.

When you run it without any options, debsums checks every file on your system against the stock md5sum files.

sudo debsums

Example: 

/usr/bin/ac                                                                   OK
/usr/bin/lastcomm                                                             OK
/usr/lib/systemd/system/acct.service                                          OK
/usr/sbin/accton                                                              OK
/usr/sbin/dump-acct                                                           OK
/usr/sbin/dump-utmp                                                           OK
/usr/sbin/sa                                                                  OK
/usr/share/doc-base/acct.acct                                                 OK
/usr/share/doc/acct/NEWS.gz                                                   OK
/usr/share/doc/acct/README                                                    OK
/usr/share/doc/acct/README.Debian                                             OK
/usr/share/doc/acct/TODO.gz                                                   OK
/usr/share/doc/acct/changelog.Debian.gz                                       OK
/usr/share/doc/acct/copyright                                                 OK
/usr/share/doc/acct/html/Preface.html                                         OK
/usr/share/doc/acct/html/ac.html                                              OK
/usr/share/doc/acct/html/accton.html                                          OK
/usr/share/doc/acct/html/dump_002dacct.html                                   OK
/usr/share/doc/acct/html/index.html                                           OK
/usr/share/doc/acct/html/lastcomm.html                                        OK
/usr/share/doc/acct/html/sa.html                                              OK
/usr/share/info/accounting.info.gz                                            OK
/usr/share/man/man1/ac.1.gz                                                   OK
/usr/share/man/man1/lastcomm.1.gz                                             OK
/usr/share/man/man8/accton.8.gz                                               OK
/usr/share/man/man8/dump-acct.8.gz                                            OK
/usr/share/man/man8/dump-utmp.8.gz                                            OK
/usr/share/man/man8/sa.8.gz                                                   OK
/usr/sbin/adduser                                                             OK
/usr/sbin/deluser                                                             OK
/usr/share/doc/adduser/NEWS.Debian.gz                                         OK
/usr/share/doc/adduser/README.gz                                              OK
/usr/share/doc/adduser/TODO                                                   OK
/usr/share/doc/adduser/changelog.gz                                           OK
/usr/share/doc/adduser/copyright                                              OK

To enable checking of every file and configuration files for each package for any changes, include the -a or --all option: 

sudo debsums --all

It is as well possible to check only the configuration file excluding all other package files by using the -e or --config option:

sudo debsums --config

Next, to only display changed files in the output of debsums, use the -c or --changed option. I didn’t found any changed files in my system. 

sudo debsums --changed

The next command prints out files that do not have md5sum info, here we use the -l and --list-missing option. On my system, the command does not show any file. 

sudo debsums --list-missing
Now it’s time to verify the md5 sum of a single package by specifying its name: 
sudo debsums apache2

We need to enable debsums in the cronjob.

/etc/default/debsums

# Defaults for debsums cron jobs
# sourced by /etc/cron.d/debsums

#
# This is a POSIX shell fragment
#

# Set this to never to disable the checksum verification or
# one of "daily", "weekly", "monthly" to enable it
CRON_CHECK=weekly