We need a public workstation verification script

[jdreed]

As discussed some time ago, we need some sort of public workstation verification script, even with the login chroots. It should perhaps run debsums, and whitelist known false-positives. Determining the canonical set of installed packages and their versions may be difficult with our update mechanism -- one option is a VM that runs athena-auto-update with no desync and generates the canonical list. Another option is that if the script detects inconsistencies, it forces an update and then checks again.

[jdreed]

Bumping this for Natty. We've been without such a script for almost 2 years, and I'm concerned we're growing too reliant on the chroot, which is a speed bump, not a locked door.

[jdreed]

debsums on my 760 (2387 packages installed) took 4m49s to run, which is ... not entirely unreasonable. We could run it out of cron in the middle of the night, and if it fails, have it create a flag file which debathena-gdm-pieces-of-flair checks for, and disables logins if it finds it. Or it could just kick off /usr/sbin/athena-auto-upgrade, I guess. However, debsums only tells us if somebody has mucked with installed packages. It won't, for example, tell us if somebody has installed their own debathena-haxx0r-config (whose md5sums will verify correctly, I'm sure). Is there a way to say "Show me everything that's installed that didn't come from an APT repo?" Which of course assumes that apt{-get,itude} haven't been compromised, but it's a decent start.

[amu]

Replying to jdreed:

Is there a way to say "Show me everything that's installed that didn't come from an APT repo?"

aptitude search '~o'

[jdreed]

aptitude search '~o'

As far as I can tell, that will only show me packages that can't be downloaded, but won't tell me if, for example, someone built their own debathena-workstation and installed it with dpkg -i.

I wonder if we should just go back to control files, because it's not like the package-list code doesn't already essentially generate that data for us.

[amu]

Replying to jdreed:

As far as I can tell, that will only show me packages that can't be downloaded, but won't tell me if, for example, someone built their own debathena-workstation and installed it with dpkg -i.

Right, I'd missed the bit about versions. :-/ To cover that angle, you could search for ~S~i!(~Odebian|~Oubuntu|~Odebathena); that will also list out-of-date packages unless you throw in !~U, but you're probably interested in those anyway, particularly if newer versions include security fixes.

[jdreed]

Re-milestoning this, as it might end up being moot in a mokafive world.

[geofft]

We're not doing mokafive. :( For a first-order verification script, we can:

• Make sure every package on the system is a recursive dependency of ubuntu-desktop, debathena-cluster, or possibly at most a dozen other "root" packages (we have some special cases which we explicitly install, for instance)
• Make sure the apt repos are what we expect
• Make sure that apt-cache policy believes that the version of each package on the system is actually installable from the apt repos (to catch a too-new version of a package)
• Run debsums
• Make sure the list of untracked files matches some known whitelist

release-team (read jdreed) seems fine with just doing this in cron as opposed to on boot as we did on Athena 9, which had the annoying side effect of making boot take like ten minutes.

[jweiss]

release-team (read jdreed) seems fine with just doing this in cron as opposed to on boot as we did on Athena 9, which had the annoying side effect of making boot take like ten minutes.

As long as it's properly desync'd I think running it out of cron is actually better than running it at boot time, since we know it will get run regularly, and we don't know how often a workstation will be rebooted.

[jdreed]

A first order approximation of this (which does not do the "make sure every package is a recursive dependency" part, because aptitude search syntax hurts my brain) is checked in in r25637 as debathena-verify.

[jdreed]

I've gone ahead and built this to -development. Nothing pulls it in yet, so please test it. At the moment, I'm primarily interested in testing it on precise cluster machines.

[andersk]

debathena-verify 1.0 now exists in production, but nothing causes it to be installed or run, so I’m setting this back to new.