Audit base system against known vulnerabilities and generate reports
including references to security advisories.
It uses pkg audit and Vuxml database as is used for packages but this script
checks base system.
Add the following lines to /etc/periodic.conf(.local) to enable periodic check
security_status_baseaudit_enable="YES"
security_status_baseaudit_quiet="NO"
Use pkg_chroots to provide a default list of chroots
and pkg_jails to provide a default list of jails (or '*' for all jails)
for all pkg periodic scripts, or set
security_status_baseaudit_chroots
and
security_status_baseaudit_jails
for this script only.
You can also change following variables:
security_status_baseaudit_period="daily"
security_status_baseaudit_expiry="2"
security/base-audit: Remove port
* Remove port as 405.pkg-base-audit, core file of the port, is merged
into ports-mgmt/pkg with pkg 1.18.1.
* Add entry to MOVED
PR: 264878
Approved by: maintainer
security/base-audit: Add the ability to specify ignored jails
security_status_baseaudit_jails_ignore is a space delimited list of jails
to ignore.
If non-empty, the code iterates over security_status_baseaudit_jails_ignore
to avoid partial matches (i.e. ignore foo.bar, but not foo). If there is a
better way to do that without looping, please let me know.
Example use case: I have jails which purposely are older vulnerable versions
for testing.
PR: 257685
Approved by: 000.fbsd@quip.cz (maintainer)
security/base-audit: upgrade 0.3 -> 0.4
- Since all supported FreeBSD versions have anticongestion function
in /etc/default/periodic.conf, always use it to insert random sleep
with non-interactive mode.
- pet portlint
PR: 236751
Submitted by: Yasuhiro KIMURA <yasu@utahime.org>
Approved by: Miroslav Lachman <000.fbsd@quip.cz> (maintainer)
security/base-audit: update 0.2 -> 0.3
- Use anticongestion function if available
PR: 230393
Submitted by: Yasuhiro KIMURA <yasu@utahime.org>
Approved by: Miroslav Lachman <000.fbsd@quip.cz> (maintainer)
security/base-audit: update 0.1 -> 0.2
- Introduce security_status_baseaudit_period variable to
files/405.pkg-base-audit.in in order to make it possible to specify
when this script is executed (i.e. daily, weekly or monthly).
PR: 224239
Submitted by: Yasuhiro KIMURA <yasu@utahime.org>, Miroslav Lachman
<000.fbsd@quip.cz> (maintainer)
Audit base system against known vulnerabilities and generate reports
including references to security advisories.
It uses pkg audit and Vuxml database as is used for packages but this script
checks base system.
