Index: ports/chapter.xml =================================================================== --- ports/chapter.xml +++ ports/chapter.xml @@ -199,13 +199,9 @@ Before installing any application, check http://vuxml.freebsd.org/ - for security issues related to the application or install - ports-mgmt/portaudit. Once installed, type - portaudit -F -a to check all installed - applications for known vulnerabilities. When - pkg is being used the audit - functionality is built in. Execute pkg audit - -F to get a report on vulnerable packages. + for security issues related to the application or type + pkg audit -F to check all installed + applications for known vulnerabilities. The remainder of this chapter explains how to use packages @@ -1119,13 +1115,11 @@ http://vuxml.freebsd.org/ for known security issues related to the port. Alternately, - if ports-mgmt/portaudit is installed, run - portaudit -F before installing a new + run pkg audit -F before installing a new port. This command can be configured to automatically perform a security audit and an update of the vulnerability database during the daily security system check. For more information, refer to the manual page for - portaudit and &man.periodic.8;. Index: security/chapter.xml =================================================================== --- security/chapter.xml +++ security/chapter.xml @@ -78,12 +78,6 @@ - How to use portaudit to audit - third party software packages installed from the Ports - Collection. - - - How to utilize &os; security advisories. @@ -3091,94 +3085,6 @@ - - - Monitoring Third Party Security Issues - - - TomRhodesContributed - by - - - - - portaudit - - - In recent years, the security world has made many - improvements to how vulnerability assessment is handled. The - threat of system intrusion increases as third party utilities - are installed and configured for virtually any operating - system available today. - - Vulnerability assessment is a key factor in security. - While &os; releases advisories for the base system, doing so - for every third party utility is beyond the &os; Project's - capability. There is a way to mitigate third party - vulnerabilities and warn administrators of known security - issues. A &os; add on utility known as - portaudit exists solely for this - purpose. - - The - ports-mgmt/portaudit - port polls a database, which is updated and maintained by the - &os; Security Team and ports developers, for known security - issues. - - To install portaudit from the - Ports Collection: - - &prompt.root; cd /usr/ports/ports-mgmt/portaudit && make install clean - - During the installation, the configuration files for - &man.periodic.8; will be updated, permitting - portaudit output in the daily - security runs. Ensure that the daily security run emails, which - are sent to root's - email account, are being read. No other configuration is - required. - - After installation, an administrator can update the - database and view known vulnerabilities in installed packages - by invoking the following command: - - &prompt.root; portaudit -Fda - - - The database is automatically updated during the - &man.periodic.8; run. The above command is optional and can - be used to manually update the database now. - - - To audit the third party utilities installed as part of - the Ports Collection at anytime, an administrator can run the - following command: - - &prompt.root; portaudit -a - - portaudit will display messages - for any installed vulnerable packages: - - Affected package: cups-base-1.1.22.0_1 -Type of problem: cups-base -- HPGL buffer overflow vulnerability. -Reference: <http://www.FreeBSD.org/ports/portaudit/40a3bca2-6809-11d9-a9e7-0001020eed82.html> - -1 problem(s) in your installed packages found. - -You are advised to update or deinstall the affected package(s) immediately. - - By pointing a web browser to the displayed - URL, an administrator may obtain more - information about the vulnerability. This will include the - versions affected, by &os; port version, along with other web - sites which may contain security advisories. - - portaudit is a powerful utility - and is extremely useful when coupled with the - portmaster port. - - &os; Security Advisories