Exercise: Interrogate the installed software

Use rpm to learn where files come from, what a package contains, and whether anything has been tampered with. You deliberately modify a program to see what verification reports.

Interrogate the installed software

Query packages with rpm -q, -qi, -ql, -qc, -qd and -qf.
Find the owner of a file.
Detect a modified file with rpm -V and repair it.

Start the exercise

On workstation, start the exercise. It makes sure the package tree is installed and intact on servera.

[student@workstation ~]$ lab start sa-rpm

Later tasks assume that you are logged in to the server they name: ssh student@servera from workstation, then sudo -i for a root shell.

Ask about a package

On servera as root (sudo -i), show the exact version of the tree package, its summary and licence, and the files it installed.

[student@workstation ~]$ ssh student@servera
[student@servera ~]$ sudo -i
[root@servera ~]# rpm -q tree
tree-1.8.0-10.el9.x86_64
[root@servera ~]# rpm -qi tree | grep -E 'Summary|License|Version'
Version     : 1.8.0
License     : GPLv2+ and LGPLv2+
Summary     : File system tree viewer
[root@servera ~]# rpm -ql tree
/usr/bin/tree
/usr/share/doc/tree
...output omitted...

Who owns this file?

Find the packages that own /usr/bin/passwd, /etc/ssh/sshd_config and /usr/bin/ssh-keygen. Is /etc/ssh/sshd_config a configuration file of that package?

[root@servera ~]# rpm -qf /usr/bin/passwd /etc/ssh/sshd_config /usr/bin/ssh-keygen
passwd-0.80-12.el9.x86_64
openssh-server-9.9p1-12.el9_8.rocky.0.1.x86_64
openssh-9.9p1-12.el9_8.rocky.0.1.x86_64
[root@servera ~]# rpm -qc openssh-server | head -3
/etc/pam.d/sshd
/etc/ssh/sshd_config
/etc/sysconfig/sshd

The client program is in openssh, the server and its configuration are in openssh-server; -qc confirms sshd_config is a configuration file.

Count and order the installed packages

How many packages are installed? Which were installed most recently?

[root@servera ~]# rpm -qa | wc -l
375
[root@servera ~]# rpm -qa --last | head -3
python3-systemd-234-19.el9.x86_64             Sat Oct  3 17:26:10 2026
python3-dnf-plugins-core-4.3.0-26.el9.noarch  Sat Oct  3 17:26:10 2026
...output omitted...

Your numbers will differ.

Verify, tamper, verify

Verify tree. Then append a character to its binary, and verify again. Read the flags.

[root@servera ~]# rpm -V tree
[root@servera ~]# echo x >> /usr/bin/tree
[root@servera ~]# rpm -V tree
S.5....T.    /usr/bin/tree

S (size), 5 (checksum) and T (time) differ: the program was modified.

Repair it

Reinstall the package and verify again. (This needs the repositories; the next lessons explain dnf.)

[root@servera ~]# dnf reinstall -y tree
...output omitted...
Reinstalled:
  tree-1.8.0-10.el9.x86_64

Complete!
[root@servera ~]# rpm -V tree
[root@servera ~]# exit
[student@servera ~]$ exit

No output: the file is back to what the package contains.

Grade and finish

Check your work with lab grade sa-rpm, then put the exercise away with lab finish sa-rpm.