Lion Cipher Lab
Reconcile installed packages against an approved manifest
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A software baseline — the list of packages a host is supposed to have, at approved versions — is a named security control: NIST's configuration-management guidance (SP 800-128) builds on exactly this idea of a known, approved configuration you measure reality against. Without it, hosts drift. Someone installs a troubleshooting tool and never removes it. A package sits two versions behind the one that fixed a CVE while the host still reports as patched for everything else. A removed package leaves its config and a dormant service behind. None of this shows up unless you reconcile what is…
What you'll learn
- exporting the installed package set with dpkg-query
- comparing it to an approved software manifest
- finding unexpected, missing and version-drifted packages
- spotting removed packages that left config behind
- a simplified version comparison and its limits
- why a software baseline is a security control
Steps in this lab
- A baseline you do not check is not a baseline
- The installed set and the manifest
- Write the reconciler
- Run it: four kinds of drift
- Operate it, and the version caveat