debsums - check the MD5 sums of installed Debian packages
Verify installed Debian package files against MD5 checksum lists from
can generate checksum lists from deb archives for packages that
don't include one.
- -a, --all
- Also check configuration files (normally excluded).
- -e, --config
- Only check configuration files.
- -c, --changed
- Report changed file list to stdout (implies
- -l, --list-missing
- List packages (or debs) which don't have an MD5 sums
- -s, --silent
- Only report errors.
- -m, --md5sums=file
- Read list of deb checksums from file.
- -r, --root=dir
- Root directory to check (default /).
- -d, --admindir=dir
- dpkg admin directory (default /var/lib/dpkg).
- Directories in which to look for debs derived from the
package name (default is the current directory).
- A useful value is /var/cache/apt/archives when using
apt-get autoclean or not clearing the cache at all. The
- apt-get --reinstall -d install `debsums -l`
- may be used to populate the cache with any debs not already
in the cache.
- Note: This doesn't work for CD-ROM and other local
sources as packages are not copied to /var/cache. Simple file
sources (all debs in a single directory) should be added to the -p
- Generate MD5 sums from deb contents. If the argument is a
package name rather than a deb archive, the program will look for a deb
named package_version_arch.deb in the directories
given by the -p option.
- Generate MD5 sums from the deb for packages which don't
- Ignore the on disk sums and use the one supplied in the
deb, or generated from it if none exists.
- Write the extracted/generated sums to
- Implies keep; the extracted/generated sums are not
checked against the installed package.
- For backward compatibility, the short option -g is
equivalent to --generate=missing.
- Report missing locale files even if localepurge is
- Report changed ELF files even if prelink is
- Treat permission errors as warnings when running as
- Print help and version information.
on success, or a combination* of the following
values on error:
- A specified package or archive name was not installed,
invalid or the installed version did not match the given archive.
- Changed or missing package files, or checksum mismatch on
- Invalid option.
*If both of the first two conditions are true, the exit status will be 3
- debsums foo bar
- Check the sums for installed packages foo and
- debsums foo.deb bar.deb
- As above, using checksums from (or generated from) the
- debsums -l
- List installed packages with no checksums.
- debsums -ca
- List changed package files from all installed packages with
- debsums -ce
- List changed configuration files.
- debsums -cagp /var/cache/apt/archives
- As above, using sums from cached debs where available.
- apt-get install --reinstall $(dpkg -S $(debsums -c) | cut
-d : -f 1 | sort -u)
- Reinstalls packages with changed files.
- The file's md5sum is good.
- The file's md5sum does not match.
- The file has been replaced by a file from a different
The default installation of debsums
package sets the debconf boolean
value debsums/apt-autogen to be "true".
This will create /etc/apt/apt.conf.d/90debsums
"debsums --generate=nocheck -sp /var/cache/apt/archives";
by the postinst script (>=2.0.7). Every APT controlled package installation
processes will execute this code fragment to generate the missing
files from the binary packages.
In order to create md5sums
files for the already installed packages, you
must run debsums_init
once after the installation of debsums
- Directory for extracting information and contents from
package archives (/tmp by default).
While in general the program may be run as a normal user, some packages contain
files which are not globally readable so cannot be checked. Privileges are of
course also required when generating sums with the keep
Files which have been replaced by another package may be erroneously reported as
is intended primarily as a way of determining what installed
files have been locally modified by the administrator or damaged by media
errors and is of limited use as a security tool.
If you are looking for an integrity checker that can run from safe media, do
integrity checks on checksum databases and can be easily configured to run
periodically to warn the admin of changes see other tools such as:
, or tripwire
Written by Brendan O'Dea <firstname.lastname@example.org>.
Based on a program by Christoph Lameter <email@example.com> and Petr
Copyright © 2002 Brendan O'Dea <firstname.lastname@example.org>
This is free software, licensed under the terms of the GNU General Public
License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A