Install debsums (verify the files shipped by installed packages)
debsums recomputes the MD5 checksum of every file installed by a .deb and compares it with the manifest dpkg stored at install time (/var/lib/dpkg/info/*.md5sums), so a binary or library that was replaced, patched or corrupted since installation shows up. It is a package-integrity spot check, not a tamper-proof integrity system: the reference sums live on the same host and root can rewrite them (that is AIDE's job, with an off-host database). No standard mandates it; Pavois carries it as a Debian defence-in-depth practice.
Checked against what is installed or registered, packages present/absent, account databases.
What Pavois checks
Pavois asserts that debsums is present in the dpkg inventory. This is an inventory-state control: it proves the tool is installed, not that a verification was ever run, and not that the result was clean. A host whose /usr/sbin/sshd was swapped passes this rule as long as the package is there. Running the verification is a separate, deliberate act (see Verify).
describe package('debsums') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -l debsums and confirm the state column reads ii:
ii debsums 3.0.2 all tool for verification of installed package files against MD5 checksums
Then actually verify the system: debsums -s is silent when every packaged file matches its recorded checksum, and prints one line per mismatch otherwise (debsums: checksum mismatch /usr/bin/curl). Use debsums -c to list only the failing files, and debsums -e to restrict the check to configuration files.
Inspect & investigate
debsums has no log file of its own and no daemon: it prints its findings on stdout/stderr. The package does ship a /etc/cron.daily/debsums job, but it is inert until you enable it in /etc/default/debsums (CRON_CHECK=daily); once enabled, the daily run mails any mismatch to root, and that mail (or your MTA's log) becomes the only durable trace. Without that, nothing is recorded and nobody is told.
Remediation
The Pavois harden plan installs the debsums package with the system package manager (package resource, action install). It does not enable the daily cron check and does not run a verification: the plan puts the tool in place, using it is an operational decision.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | debsums |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without debsums you have no quick way to answer "is this binary still the one Debian shipped?" after an incident. The limits and side effects are worth stating plainly: a full debsums -a reads every packaged file on disk, which is I/O-heavy and noticeable on a busy or spinning-disk host; legitimately edited conffiles produce expected mismatches (filter them with debsums -e or accept the noise); some packages ship no md5sums at all, so their files are silently unverifiable; and an attacker with root can regenerate the reference sums, which is exactly why debsums complements, and never replaces, an AIDE database kept off the host. Installing it changes no runtime behaviour and cannot break a service.