Checksum-checker Tool

CSA provides a checksum-checker tool to verify the authenticity of CSA code files. This tool and a jarsigner tool that is included in Java JDK (but not in Java JRE) can be used to validate your CSA installation. The tool may uncover some modifications to CSA code files that may be malicious. It may be useful to run it after a breach is detected and mitigated to ensure that CSA code files has not been maliciously modified during a breach, or it can be useful for ordinary integrity check.

The tool is used post-installation.

Before Running the Checksum-checker Tool

Within your CSA installation, run a command line (Windows) or a shell (Linux) and navigate to the CSA_HOME\Tools\Security directory.

The first step is to verify that the checksum checker is signed. Execute the jarsigner command (available from Java JDK) in the specified directory:

jarsigner -verify checksum-checker.jar

You should get a response:

jar verified.

Once you verify the checksum-checker, you can use the tool to verify the rest of the CSA installation.

For complete assurance, you can run it with -verbose and -certs arguments to see if code signing certificate comes from HPE.

Once you verify the checksum-checker, you can use the tool to verify the rest of the CSA installation.

Using Checksum-checker

The tool can be used after mitigating potential security breach or just for plain file integrity validation.

To use the checksum-checker, follow these Steps (for plain file integrity validation without presence of adversary, you can skip directly to step 4):

1. Disconnect the systems from the network, to verify if the attacker has modified the CSA installation;
2. Check your OS to see if it is negatively affected;
3. Check the java files to verify if the Java is modified in any way;
4. Check checksum-checker with jarsigner (as described above);

5. Check to see if CSA code is modified via the checksum-checker. You can do this using the following command in the CSA_HOME\Tools\Security directory:

   java -jar checksum-checker.jar

   The tool will run through the files and give you the list of validated files. At the end of list there is a summary of files that did not pass the check.

   For example, let's see what would the checksum-checker.jar will report if the provider-tool file (in the CSA_HOME\Tools\ProviderTool directory) has been modified.

   The checksum-checker.jar will provide a message with the name of the file that has unexpected checksum at the end of its output like this:

   Files with wrong checksums:

   Tools/ProviderTool/provider-tool.jar

   Note: The checksum-checker tool can only verify CSA code files, not configuration files. It verifies only known files and ignores unknown ones. Checksum-checker will report wrong checksums for CSA applied hotfixes; it can only validate full version installations, patch releases, and version updates within CSA installations. The checksum checker uses SHA-256 algorithm for checksums.

   The checksum-checker.jar can also run from different directory than CSA_HOME\Tools\Security, if the argument --installdir followed by the location of CSA_HOME directory is specified.