How to find packages by a specific file on Ubuntu

This guide will help you identify the package that owns / provides a particular file on your Ubuntu system. All commands in this article have been tested on Ubuntu 18.04 and Ubuntu 16.04 Desktop and Server edition.

Sometimes it is necessary to know the package that adds files to your system, usually this is important for monitoring and security purposes, such as preventing rootkits and any form of intrusion on your Linux server.

Below is a list of commands that will come in handy for this task.

Using dpkg

dpkg is a Debian package management tool used to install, remove, update and manage Debian packages. You can use the dpkg package management tool to identify the package that the file provides. The following options are possible:

-S, – search: they are used to find the filename from installed packages.

As an example, let’s try to identify the package that /etc/updatedb.conf provides.

# dpkg -S /etc/updatedb.conf
mlocate: /etc/updatedb.conf

As you can see, the file was written to the file system using the mlocate package.

You can also do the same for the binary, for example

# dpkg -S /bin/sync
coreutils: /bin/sync

If you don’t know the absolute path to the command, you can use the command whichto find it on the fly.

# dpkg -S `which ping`
iputils-ping: /bin/ping

or

# dpkg -S $(which ping)
iputils-ping: /bin/ping

Using apt-file

Apt-file is a Debian command line tool that can be used to find files in packages for the APT package management system. If you try to run a command when it is not installed, it will ask you to install it.

# apt-file search vim
The program 'apt-file' is currently not installed. You can install it by typing:
apt install apt-file

By default, the system cache is empty. Run the following command as root user to refresh the cache.

# apt-file update

Use the syntax:

# apt-file search <file>

for instance: To find the package that created the /etc/nginx/nginx.conf file, use the command:

# apt-file search /etc/nginx/nginx.conf 
nginx-common: /etc/nginx/nginx.conf

You can see from the output that the file was created by installing the package nginx-common

Using the Ubuntu Packages web interface

The third way is to use the Ubuntu Packages web search interface available from the Ubuntu Packages page (https://packages.ubuntu.com/). Enter a keyword and click on the search box.

Output

The two commands apt-file and dpkg are sufficient to find a file from a package on Ubuntu and all Debian-based Linux distributions. This can help you find a package to reinstall if it is corrupted from a file or is tracking unknown files on your file system.

Related Posts