Very Computer

Hi All,

I am using debian stable, and after a doing a dist-upgrade, I got some
md5 errors.  Now, new packages are no longer install correctly by
apt-get (dpkg works fine, though).  I'm pretty sure the problem is
with the ncurses-base package.  Here is what I get:

# dpkg --configure ncurses-base
Setting up ncurses-base (5.0-6.0potato1) ...
dpkg: error processing ncurses-base (--configure):
 md5sum gave malformatted output `6b60f35a7fb6122a53b1e74e56cba56e'
Errors were encountered while processing:
 ncurses-base

I am quite clueless about dpkg and apt-get, and can't seem to find any
good info on them (plus, since ncurses isn't configured, man doesn't
work).  Any help would be greatly appreciated.

Thanks,

Mike.

I had the same error a few day before. The solution was: The system
was hacked and the md5sum program was replaced by a compromised
version. Look at uid and gid of md5sum... Use chkrootkit
(www.chkrootkit.org) for checking your version...

Good luck,
Andreas

Thanks for the try, but chkrootkit found nothing.  I suspected this
would be the case, since the machine in question is behind a NAT
router, which blocks everything but outgoing HTML and POP, and since
no services except sshd are enabled on the machine anyway.

However, I do suspect that the MD5 program is to blame because, out of
desperation, I ran debsums, and it gave me:

md5sum: invalid option -- v
Try `md5sum --help' for more information.

I'm not really familiar with the md5sum program, or the debsub
program, but given the behavior of apt-get, I have to believe
something's wrong with md5sum.

My initial impulse was to try reinstalling md5sum, but I can't figure
out what package it's part of, because, for the life of me I can't
figure out the dpkg/apt-get version of rpm -qf.  Can anyone tell me
which package md5sum belongs to, or what the dpkg/apt equivalent of
rpm -qf is?

Thanks much,

Mike.

Its part of the dpkg package. You can find this information on

        http://www.debian.de/distrib/packages

by typing md5sum in the second input field on this page ("Search the
contents of packages").

By the way our system is installed behind a firewall. The CERT thinks,
that the hacker uses the CRC32 bug in sshd... However, look for a
reason why your md5sum is buggy and then, make a backup of your
md5sum, and finally install a new one:

        apt-get install --reinstall dpkg.

If you like it, try

        type -a md5sum   --> md5sum is /usr/bin/md5sum

        md5sum /usr/bin/md5sum   --->
                6f8a1b6e63dfd20b4aa5ed66f2dd7e23 /usr/bin/md5sum

before and after reinstallation.

Lefuet

Thank you so much!  It didn't quite work the way you said.  I had to
d/l the dpkg package and install it using dpkg (apt-get complained and
did nothing).  Now everything works, just in time for me to update
zlib :-).  BTW, was there any way for me to know that md5sum was part
of dpkg?  I did search packages.debian.org for "md5sum" and came up
with 3 packages, all of which used it, but none of which contained it.

Thanks much,

Mike.

Quote:> > Its part of the dpkg package. You can find this information on

> >  http://www.debian.de/distrib/packages

> > by typing md5sum in the second input field on this page ("Search the
> > contents of packages").
> BTW, was there any way for me to know that md5sum was part
> of dpkg?  I did search packages.debian.org for "md5sum" and came up
> with 3 packages, all of which used it, but none of which contained it.

Yes it was. Read my message again (-: Simply type an arbitrary file
name into the second input field of the above mentioned www page and a
few second laters you get your result...

I use this service of debian quite often to find utilities. Thanks to
DEBIAN!

Andreas