Index: ports/chapter.xml
===================================================================
--- ports/chapter.xml
+++ ports/chapter.xml
@@ -199,13 +199,9 @@
Before installing any application, check http://vuxml.freebsd.org/
- for security issues related to the application or install
- ports-mgmt/portaudit. Once installed, type
- portaudit -F -a to check all installed
- applications for known vulnerabilities. When
- pkg is being used the audit
- functionality is built in. Execute pkg audit
- -F to get a report on vulnerable packages.
+ for security issues related to the application or type
+ pkg audit -F to check all installed
+ applications for known vulnerabilities.
The remainder of this chapter explains how to use packages
@@ -1119,13 +1115,11 @@
http://vuxml.freebsd.org/
for known security issues related to the port. Alternately,
- if ports-mgmt/portaudit is installed, run
- portaudit -F before installing a new
+ run pkg audit -F before installing a new
port. This command can be configured to automatically
perform a security audit and an update of the vulnerability
database during the daily security system check. For more
information, refer to the manual page for
- portaudit and
&man.periodic.8;.
Index: security/chapter.xml
===================================================================
--- security/chapter.xml
+++ security/chapter.xml
@@ -78,12 +78,6 @@
- How to use portaudit to audit
- third party software packages installed from the Ports
- Collection.
-
-
-
How to utilize &os; security advisories.
@@ -3091,94 +3085,6 @@
-
-
- Monitoring Third Party Security Issues
-
-
- TomRhodesContributed
- by
-
-
-
-
- portaudit
-
-
- In recent years, the security world has made many
- improvements to how vulnerability assessment is handled. The
- threat of system intrusion increases as third party utilities
- are installed and configured for virtually any operating
- system available today.
-
- Vulnerability assessment is a key factor in security.
- While &os; releases advisories for the base system, doing so
- for every third party utility is beyond the &os; Project's
- capability. There is a way to mitigate third party
- vulnerabilities and warn administrators of known security
- issues. A &os; add on utility known as
- portaudit exists solely for this
- purpose.
-
- The
- ports-mgmt/portaudit
- port polls a database, which is updated and maintained by the
- &os; Security Team and ports developers, for known security
- issues.
-
- To install portaudit from the
- Ports Collection:
-
- &prompt.root; cd /usr/ports/ports-mgmt/portaudit && make install clean
-
- During the installation, the configuration files for
- &man.periodic.8; will be updated, permitting
- portaudit output in the daily
- security runs. Ensure that the daily security run emails, which
- are sent to root's
- email account, are being read. No other configuration is
- required.
-
- After installation, an administrator can update the
- database and view known vulnerabilities in installed packages
- by invoking the following command:
-
- &prompt.root; portaudit -Fda
-
-
- The database is automatically updated during the
- &man.periodic.8; run. The above command is optional and can
- be used to manually update the database now.
-
-
- To audit the third party utilities installed as part of
- the Ports Collection at anytime, an administrator can run the
- following command:
-
- &prompt.root; portaudit -a
-
- portaudit will display messages
- for any installed vulnerable packages:
-
- Affected package: cups-base-1.1.22.0_1
-Type of problem: cups-base -- HPGL buffer overflow vulnerability.
-Reference: <http://www.FreeBSD.org/ports/portaudit/40a3bca2-6809-11d9-a9e7-0001020eed82.html>
-
-1 problem(s) in your installed packages found.
-
-You are advised to update or deinstall the affected package(s) immediately.
-
- By pointing a web browser to the displayed
- URL, an administrator may obtain more
- information about the vulnerability. This will include the
- versions affected, by &os; port version, along with other web
- sites which may contain security advisories.
-
- portaudit is a powerful utility
- and is extremely useful when coupled with the
- portmaster port.
-
-
&os; Security Advisories