Security of compiling and installing many things yourself.

joeBuffer · 08-19-2009, 03:22 PM

What kind of difference is there in security if you compile and install things yourself regularly? Some programs they release patches for. Other programs are just updated to the next version. What do you do if you compile and install things yourself regularly to make sure you don't have security problems caused by it? Do you really need to?

mostlyharmless · 08-19-2009, 03:40 PM

Security is much better, theoretically, if you read and understood all the source code, as you would be able to know there are no backdoors and do your own security audit. In practice, most security is gained by (1) using the unix security model, ie permissions, correctly (2) not downloading things you don't understand from sites you don't trust (3) at least checking the GPG on things you do download. Do you need to to? Like any security, including home security, that depends entirely on what you're protecting and what your risk tolerance is.

joeBuffer · 08-19-2009, 03:51 PM

If you can quickly explain to me how to use gpg, I'd really appreciate it. I'm reading about it, and I can't understand how to use it.

mostlyharmless · 08-19-2009, 04:01 PM

Well, that or MD5 hashs. The point is, trust but verify. Trust Allah but tie up your camel. Something like that.
Here's an example: Let's say I was downloading from my favorite site
http://slackware.cs.utah.edu/pub/slackware

Looking at one of the CHECKSUM files, it says this:

Quote:

These are the MD5 message digests for the files in this directory.
If you want to test your files, use 'md5sum' and compare the values to
the ones listed here.

To test all these files, use this command:

md5sum -c CHECKSUMS.md5 | less

'md5sum' can be found in the GNU coreutils package on ftp.gnu.org in
/pub/gnu, or at any GNU mirror site.

MD5 message digest Filename
6ccaf5a3f397c770feb8c2ca77af0bae ./FILE_LIST

Don't use GPG myself, but some files come with that instead of MD5 and I assume the procedure is equally simple.

mostlyharmless · 08-19-2009, 04:04 PM

This looks like the relevent bit out of http://www.dewinter.com/gnupg_howto/...niHowto-5.html

Quote:

To sign data with your own key, use the command:

gpg -s (or --sign) [Data]

By doing this also compression takes place. This means that the result is not legible. If you want a legible result you can use:

gpg --clearsign [Data]

this will make sure that the results are clearly legible. Furthermore it does the same (signing data).

With

gpg -b (or --detach-sign) [Data]

you can write the signature in a separate file. It is highly recommended to use this option especially when signing binary files (like archives for instance). Also the --armor option can be extremely useful here.

Quite often you find that data is encrypted and signed as well. The full instruction looks like:

gpg [-u Sender] [-r Recipient] [--armor] --sign --encrypt [Data]

The functionality of the options -u (--local-user) and -r (--recipient) are as described before.

When encrypted data has been signed as well, the signature is checked when the data is decrypted. You can check the signature of signed data by using the command:

gpg [--verify] [Data]

This will only work (of course) when you own the public key of the sender.

joeBuffer · 08-19-2009, 04:09 PM

I thought it was less complicated than it is. I tried doing this with SDL. I ran

Code:

gpg --verify blahblah.tar.gz.sig

then I tried

Code:

gpg --verify blahblah.tar.gz.sig blahblah.tar.gz

and something else.
I have no idea what I'm supposed to do other than that, so I'm going to give up on it until I read more.
---
I was thinking that maybe security would be weakened by downloading and compiling and installing things yourself, possibly.

mostlyharmless · 08-19-2009, 04:14 PM

Quote:

I have no idea what I'm supposed to do other than that, so I'm going to give up on it until I read more.

Me neither, good idea.

Quote:

I was thinking that maybe security would be weakened by downloading and compiling and installing things yourself, possibly.

Can't imagine how that would be.

chrism01 · 08-19-2009, 07:55 PM

It could be weakened timewise. If you download & compile from source, then every time there is an update, you have to find time to do it.
The more apps/tools you do that for, the longer that'll take, multiplied by the number of machines (unless identical).
Also multiply by time taken to read & check/think about the src code changes. Unless you are a really(!) sharp programmer, its unlikely you'll spot something no-one else has.
OTOH, if you stick to reliable srcs eg centos/rhel repos, then you can just run yum update and you're done.
There's also the possibility that you'll custom compile/link it slightly differently to the expected way, which theoretically could lessen the security.

GazL · 08-20-2009, 02:41 AM

@joeBuffer

The slack-basics book has a reasonable introduction section on using gpg.