Advanced

Check Your ISO Checksums Before Installing Any Version Of Linux

Posted by gary_newell on · 8 comments
Everyday Linux User; By Gary Newell 		Mail this story
Print this story

After the Linux Mint issues that have occurred in recent days in brings to light the importance of checking the ISO image against the checksums provided on the distribution's website. This guide shows you how.

Full Story

  Nav
» Read more about: Story Type: Tutorial

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (8)

dotmatrix ·
They should also update the ISO checksums to SHA256... MD5 is very very broken.

Gary Newell in article wrote:MD5 is the option you need to choose if you are using Linux Mint. For other distributions this option may be SHA256.
hughesjr ·
Right, the should be using sha256. not md5
seatex ·
They just released a security update for Mint Update today. Hopefully they will adopt SHA256 as well.
BernardSwiss ·
(As I understand the matter) for the purposes that Mint is using MD5 -- ie. verifying the integrity of a downloaded ISO -- MD5 is still consider sufficient (as the task of creating an altered large image with the same checksum is not yet feasible).

And in this case, it doesn't matter anyhow; as any malicious party who is able to change the download link on the official distribution download page, to point to some bogus image on some Bulgarian server instead of the the official ISO, can just as easily change the checksum(s) on the same web-page as the link to match their trojan ISO -- whether the checksums are are MD5 or SHA256 or whatever.
mbaehrlxer ·
right, those checksums are nothing but a verification that no bits fell over while the download happened.

to get true verification, download files need to be signed with eg a pgp key, where the private key is stored off-site and can't be accessed by any intruders.

greetings, eMBee.
gary_newell Story submitter ·
You need GPG to check the validity of the checksum and the SHA256 checksum to check the validity of the ISO.

The process for checking the whole GPG thing needs to be better defined with better instructions. If you are a Windows user moving to Linux then the software available is very complex with very few instructions.

People will just skip it and hope for the best.

Maybe there should be a central website which stores all the checksums as well as the distributions own site. If the checksum website gets hacked you can verify with the distribution and vice versa.
dotmatrix ·
>Maybe there should be a central website which stores all the checksums as well as the distributions own site. If the checksum website gets hacked you can verify with the distribution and vice versa.

I second this idea... however, it would be better implemented in a way similar to DKIM and SPF for email...

SPF has a DNS record pointing to the domain or IP of a 'trusted' sender.

DKIM automatically signs the email envelope and checks the signature and body hash on the other side...

Translate to distro ISO distribution means:

Place a DNS TXT record for a designated domain or IP for the ISOs.

Create an auto-sign ISO server program -- could use DKIM as a base --

Then either/or/and create a browser extension / DL_ISO program which checks the DNS records for the designated ISO domain and auto-verifies the ISO server signatures and ISO hash.
dotmatrix ·
Here... I drew a diagram to visualize my idea - if anyone is interested...

   .------------------------.
   |   DNS TXT Record #1    |
   |                        |
   | The IP Address or FQDN |-------------------.
   | -of the ISO collection |                   |
   '------------------------'                   |
                                                v
                                              .--.               
   .------------------------.             _ -(    )- _           
   |   DNS TXT Record #2    |        .--,(            ),--.      
   |                        |    _.-(                       )-._ 
   |   The public key for   |-->(           INTERNET            )----.
   |   -the ISO collection  |    '-._(                     )_.-'     |
   '------------------------'         '__,(            ),__'         |
                                           - ._(__)_. -              |
                                                ^                    |
        .------------.                          |                    |
        | Signed ISO |                          |                    |
        |            |--------------------------'                    |
        '------------'                                               |
               ^                     .---------------------.         |
               |                     |  Browser Extension  |         |
               |                     |     DNS look-up     |<--------'
               |                     |                     |
    .---------------------.          '---------------------'
    |   Server program    |                     |
    |   auto-signature    |                     |
    |                     |                     v
    '---------------------'          .--------------------.
               ^                     | Browser Extension  |
               |                     |     IP Verify      |
               |                     '--------------------'
      .-----------------.                       |
      |   Private Key   |                       |
      |                 |                       v
      '-----------------'            .---------------------.
                                     |  Browser Extension  |
                                     |  Signature verify   |
                                     |                     |
                                     '---------------------'
Read the whole comment

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post