Home / ubuntu / Questions / 1519767
Accepted
Adalbert Hanßen
Asked: 2024-07-07 06:35:56 +0800 CST

Explain how the gpg verification and key obtaining documented in "How to verify your Ubuntu download" is safe against a MITM attack

  • 772

Some Ubuntu mirror servers still use http instead of https. In addition, a manipulated iso image version with a matching sha256 sum could be foisted on a download server. To ensure tamper-proof and transmission-proof iso images, the servers offer two files: SHA256SUMS and SHA256SUMS.gpg.

SHA256SUMS contains the file names of the offered variants of iso files with the corresponding sha256 sums.

A tutorial suggests to tamper-check these two files like this:

  1. gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

    This command verifies SHA256SUMS by the detached signature from SHA256SUMS.gpg and returns the fingerprint and pretended issuer of the key with which the signature had been computed. In my case it still says that it is only an alleged source and nothing indicates that the signature really belongs to the alleged owner.

  2. gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys <key ID from previous step, the one without blanks, the whole thing prepended with 0x>

I would like to know why command 2., suggested in How to verify your Ubuntu download, is safe against a man in the middle attack

system-installation

1 Answers

  1. Best Answer

    OBLIGATORY DISCLAIMER: I am an IT Security professional. I have been doing ITSec for 10+ years. The vast majority of this answer is trimmed down from actual explanations and security trainings for brevity, and an entire discussion on this is its own 30-minute-plus security training session (which I charge $250/hour for) so I will not be giving you the full details I'd give in such a presentation.

    None of these commands are intrinsically safe from MITM. The only reason you'd be safe from MITM is if you get your information from trusted sources for keys, etc. for validation.

    I won't go into details (as a discussion of how MITM works and how you can be vulnerable to it is its own 30-minute session for the CISSP exam training), but MITM only works if they've already hijacked you. This is why you have to make sure information you get ahead of time is from legitimate sources for validation. So, part of your job to protect against MITM is to make sure you're using legitimate sources of information. And that starts at your computer - making sure you're using proper DNS servers, not using bad DNS servers, that you don't have any rogue hosts file entries for domains, etc.

    SO, you have to make sure you have legitimate information.

    As of July 7, 2024, the following information is verified legitimate:

    1. The keyserver.ubuntu.com domain resolves to 185.125.188.26 and 185.125.188.27 for IPv4 and 2620:2d:4000:1007::70c and 2620:2d:4000:1007::d43 for IPv6. If your entries for keyserver.ubuntu.com don't resolve to this, then you're already screwed.

    2. The keys to expect for the SHA256SUMS file are: (note I have a mirror myself of the Ubuntu releases site/mirror so I pulled this locally, but the origin is from releases.ubuntu.com from a trusted system)

      $ gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
gpg: directory '/home/teward/.gnupg' created
gpg: keybox '/home/teward/.gnupg/pubring.kbx' created
gpg: Signature made Thu Apr 25 13:26:32 2024 EDT
gpg:                using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092

    3. The current information about this key is as follows:

      Type: RSA
Bit strength: 4096 bits
RSA Key ID: rsa4096/843938df228d22f7b3742bc0d94aa3f0efe21092
Creation Date: 2012-05-11T22:10:48Z
Comment: Ubuntu CD Image Automatic Signing Key (2012) <[email protected]>

    4. Armed with the key and the SHA256SUMS and SHA256SUMS.gpg you can now validate the key:

    $ gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
gpg: Signature made Thu Apr 25 13:26:32 2024 EDT
gpg:                using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
    Primary key fingerprint: 8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092

    Note that the warning about 'trusted' is only because we do not have the full trust chain and you do not have keys listed from the Signatures on the key that are trusted to you that indicate this is the legitimate key. That's why it's crucial to get your data from a trusted source so you KNOW you're working with legitimate data and not bogus data.

    Note, however, I'm showing you the output from a system that is not my primary Linux system. My primary linux system has GPG keys stored in its keyring from various Ubuntu developers, Debian developers, etc. who I have vetted myself or have gotten to know and met over the years, and on my system the key does NOT show this warning because the trusted signers I already know have signed the package signing key. Because of the keys I know from others being marked as Trusted in my GPG keyrings, validation of the signing key on my actual machine shows Trusted, and the warning you see and I mentioned in my example above, the 'web of trust' from those signatures enhances and validates the trustworthyness of the key.

    The only way to make sure you're protected from MITM is trusting the sources of data you are using to get your information and keys from and verifying the legitimate source. There is no other intrinsic MITM protections anywhere at play.

    • 1