Your package manager remembers
Every installed Debian package records a checksum for each file it ships, written at install time into /var/lib/dpkg/info. Verifying the whole system walks that record and prints only the files that no longer match - on a clean machine it prints nothing at all. Here it names one file, and the 5 in the flag column means the checksum is wrong. Asking which package owns the file, then comparing the checksum on disk against the one recorded at install, shows the two do not agree. No agent, no external database and no internet lookup were involved: the reference was already on the machine, put there by the installer. This needs nothing extra installed, which makes it the first check to run on a box you have inherited.
Your package manager already knows what every file on disk should look like.
Something replaced a system binary. It still runs, it still reports the right version, and nothing in your logs mentions it.
Every installed package ships a list of checksums, written when the package was installed. One command walks all of them and prints only the files that no longer match.
Here it names exactly one. The five in that column means the checksum is wrong.
Ask which package owns the file, then compare what is on disk now against what was recorded then.
They do not match. No agent, no external database, no internet lookup. The evidence was already sitting on the machine, put there by the installer.
Run the verify on your own box, and read whatever it prints.
#linux#security#selfhosted#devops#sysadmin
❯ Run the verify on your own box, and read whatever it prints.