How to verify installed package files with debsums and rpm -Va

Packages already have a baseline

Every package records checksums for the files it installs. Comparing installed files to those checksums finds binaries and libraries that changed since installation, without building your own baseline first. It is a quick check during live response.

The limitation is that an attacker with root can also edit the package database. Use it as a fast first pass, and compare against a known-good mirror or a separate system when the stakes are high.

Debian and Ubuntu

debsums -s prints only files whose checksums do not match. debsums -c checks changed files including configuration, and -e restricts to config files. dpkg --verify gives similar output in rpm’s format on newer dpkg versions.

Configuration files under /etc change legitimately, so focus first on binaries in /usr/bin, /usr/sbin, and /usr/lib.

Snippet

sudo apt install debsums
sudo debsums -s 2>/dev/null
sudo dpkg --verify | grep -v " c /etc/"

Lab: tamper and detect on RHEL-family

rpm -Va verifies every installed package. Each output line has a nine-character flag string: S size, M mode, 5 digest, D device, L link, U user, G group, T mtime, P capabilities, and a c marker for config files. A line like S.5....T. /usr/bin/ls means size, digest, and mtime changed on a binary, which is serious.

On a lab VM, append a byte to a copy-safe binary such as /usr/bin/cal, run rpm -Vf /usr/bin/cal, and read the flags. Restore it with dnf reinstall.

Snippet

sudo rpm -Va 2>/dev/null | grep -v " c /"
echo | sudo tee -a /usr/bin/cal >/dev/null   # lab only
rpm -Vf /usr/bin/cal
sudo dnf reinstall -y util-linux

When a binary does not match

Find which package owns it, check whether an update is in progress, and compare its hash to the same package version on a clean host. If it differs and no explanation exists, treat the host as compromised.

Reinstalling the package replaces the file but does not remove whatever placed it there. Investigate first.

Diagram

Reading rpm -Va flags

Sample verify output from a lab VM.

rpm -Va

S.5....T.  c /etc/ssh/sshd_config
..5....T.    /usr/bin/cal
.M.......    /var/log/wtmp

The first line is a changed config file, usually legitimate.
The second is a binary with a different digest and mtime: investigate.
The third is only a mode change on a log file: check, often benign.

Check yourself

1. In rpm -Va output, what does the 5 flag mean?

2. Which command prints only mismatched files on Ubuntu?

3. Why is package verification not a complete defense?