portaudit provides a system to check if installed ports are listed in a
database of published security vulnerabilities.
After installation it will update this security database automatically and
include its reports in the output of the daily security run.
If you have found a vulnerability not listed in the database, please contact
the FreeBSD Security Officer <security-officer@FreeBSD.org>. Refer to
http://www.freebsd.org/security/#sec
for more information.
WWW: http://people.freebsd.org/~eik/portaudit/
Oliver Eikemeier <eik@FreeBSD.org>
Avoid unnecessary invocations of pkg_info by checking whether the
package is installed or not using a precalculated regex.
This speeds up "portaudit -a" with around a factor of 10.
The change is slightly modified from the one from the PR by using
pkg_info -aE instead of ls /var/db/pkg for determining installed
packages.
Submitted by: Kuang-che Wu <kcwu@csie.org>
PR: ports/92942
Change MAINTAINER address for ports maintained by the Security Team to
secteam@ instead of security@ to make it more clear that the ports are
not maintained by the freebsd-security@ mailing list. Both addresses
go to the same people.
portaudit 0.5.10:
- Unbreak portaudit -vF.
- Sync usage with reality.
- Document the q, v, and V options.
- Markup fixes for the portaudit(1) manual page.
- Make quiet mode output even less "redundant" text [1].
- Set maintainership to security@. [2]
Suggested by: Phil Kernick philk at rotfl dot com dot au [1]
Suggested by: nectar, remko [2]
Grab maintainer-ship of portaudit. While I do not currently have any
plans for improvements (though I have ideas) I feel that portaudit is
too important to not have an active maintainer.
Approved by: portmgr (linimon)
fix man page nits,
modify the vulnerability report depending on -q/-v (experimental)
PR: 69935, 68942
Submitted by: Chris Pepper <pepper@reppep.com>, Johan Karlsson
<k@numeri.campus.luth.se>
- update to version 0.5
*** NOTE ***
The preferences file format has changed, as have the periodic.conf(5) names.
Normally the default settings should be adequate, except when you need to
configure a proxy. Use $PREFIX/etc/portaudit.conf.sample as an example.
- moved portaudit to sbin
- clean up, merging stuff into the portaudit script
- better return codes and errors to stderr
- -f can check stdin now
- dropped ports tree auditing
- merged the periodic(8) scripts into one
- run daily auditing as `nobody'
Update to version 0.4, with a new `-f' option.
To check which of the current ports have known vulnerabilities, do
portaudit -f /usr/ports/INDEX
This port requires pkg_install(-devel)>=20040623
update to 0.3.1:
- use passive ftp by default, don't retry on failure [1]
- add a -C flag, portlint style
- don't keep databases that are tool old [2]
Requested by: hubs [1]
Noticed by: Nicolas Rachinsky <nicolas@rachinsky.de> [2]
Update to 0.3.
Since we are using the official VuXML database
the auditing should be pretty complete.
- mention web page
- add more mirrors, disabling .ru mirror (too much lag)
- allow combined options in portaudit shell script
- add sample configuration file
- use absolute paths for binaries, to ease use in crontab scripts [1]
- correct type in man page [2]
PR: 64005 [2]
Submitted by: Tomasz Pilat <poncki@axelspringer.com.pl> [1]
Nathan Dove <njdove@wafer.sandia.gov> [2]
- bugfix: awk in -CURRENT accepts no regexes in RS, causing the database
update to fail
- add an install & deinstall message
Submitted by: nectar & Ion-Mihai Tetcu <itetcu@apropo.ro>
update to 0.2:
- new command line tool
- new man page
- reworked database update code, incorporating feedback from
Max Khon <fjoe>, Radim Kolar <hsn@netmag.cz> (PR 63066) and
Ion-Mihai Tetcu <itetcu@apropo.ro> (PR 62655)
Disable auditfile.txt until we decide on a database format,
two databases cause more confusion than it is worth.
portaudit uses ports/security/vuxml/vuln.xml in the meantime,
please commit your changes there and send feedback wich format
you prefer.
Currently we have to migrate gnats, mailman, monkey and some
apache versions.
portaudit provides a list of published security vulnerabilities
of FreeBSD ports and tools to check if installed ports are listed.
Since this is a prerelease version, it is mostly usable for
committers that want to contribute to the project, and can currently
not be relied upon as an extensive security auditing tool.
