Verify the integrity of downloaded ISO files

You should always verify any downloaded ISO file. The reason is that the file may have been maliciously modified by a hacker and can install malware like backdoors, keyloggers etc into your computers.

The ISO file is signed using the private key to create a digital signature. The public key is used to verify the signature. The digital signature file is used to verify the ISO file.

This verifies that the file has been created by the owner himself, since nobody else has his private key. Also, it verifies that the file has not been modified or tampered in any way. 

1) Download the ISO file.

[shabbir@block1 Downloads]$ wget https://github.com/Security-Onion-Solutions/security-onion/releases/download/v14.04.4.1/securityonion-14.04.4.1.iso


2) Download the digital signature for the above downloaded ISO file.

[shabbir@block1 Downloads]$ wget https://github.com/Security-Onion-Solutions/security-onion/raw/master/securityonion-14.04.4.1.iso.sig


3) Download the public key.

[shabbir@block1 Downloads]$ wget https://raw.githubusercontent.com/Security-Onion-Solutions/security-onion/master/KEYS

4) Import the public key in your public keyring.
[shabbir@block1 Downloads]$ gpg --import KEYS

5) View your public keyring
[shabbir@block1 Downloads]$ gpg2 --list-keys
/home/shabbir/.gnupg/pubring.gpg
--------------------------------
pub   4096R/ED6CF680 2012-06-29
uid                  Doug Burks <doug.burks@gmail.com>
sub   4096R/C5D9F4EB 2012-06-29

6) Verify the ISO file using the signature file.
[shabbir@block1 Downloads]$ gpg --verify securityonion-14.04.4.1.iso.sig securityonion-14.04.4.1.iso
gpg: Signature made Sat 19 Mar 2016 05:32:50 PM IST using RSA key ID ED6CF680
gpg: Good signature from "Doug Burks <doug.burks@gmail.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BD56 2813 E345 A068 5FBB  91D3 788F 62F8 ED6C F680