MD5 and Sha verification commands

Linux software is often provided for download in the form of an image. But how do we ensure that the downloaded files have not been tampered? In Linux, MD5 and Sha verification are generally performed on the downloaded files.

MD5

We use the iptraf software for testing:

 

We can see that the official team has gone through the md5value, and the official team wants to run the md5sum command on the downloaded tar.gz file to check whether the calculated md5sum value is consistent with the official team.

Command:

$ Md5sum iptraf-3.0.0.tar.gz

Result:

377371c28ee3c21a76f7024920649ea8 iptraf-3.0.0.tar.gz

We may see that these two values are the same, indicating that there is no problem with the package.

Sha

We use the centos environment image to test:

Run sha1sum for verification.

Command:

$ Sha1sum CentOS-6.5-i386-LiveCD.iso

Result:

3cf41ef12362ad363ff0650c703d3d045bcbfa7a CentOS-6.5-i386-LiveCD.iso

We can see that there is no problem with this situation.

Tips

Generally, MD5 verification is enough for software. However, it is recommended that sha be used for verification for key software (such as the System), which makes it safer.

In addition, if the webpage on the software official website is tampered with (both the software package and the MD5 and Sha values are modified), even if the Sha and MD5 verification are correctly downloaded, the software may still be faulty.

MD5 and Sha verification commands