Update to 0.3.
Since we are using the official VuXML database the auditing should be pretty complete. - mention web page - add more mirrors, disabling .ru mirror (too much lag) - allow combined options in portaudit shell script - add sample configuration file - use absolute paths for binaries, to ease use in crontab scripts [1] - correct type in man page [2] PR: 64005 [2] Submitted by: Tomasz Pilat <poncki@axelspringer.com.pl> [1] Nathan Dove <njdove@wafer.sandia.gov> [2]
This commit is contained in:
Oliver Eikemeier
parent
1a9fde3cfb
commit
1832c23a94
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=103635
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
PORTNAME= portaudit
|
||||
PORTVERSION= 0.2.1
|
||||
PORTVERSION= 0.3
|
||||
CATEGORIES= security
|
||||
DISTFILES=
|
||||
|
||||
@ -36,17 +36,18 @@ RUN_DEPENDS= ${LOCALBASE}/sbin/pkg_info:${PORTSDIR}/sysutils/pkg_install-devel
|
||||
|
||||
.include <bsd.port.pre.mk>
|
||||
|
||||
.if ${OSVERSION} < 420001 || ${OSVERSION} >= 500000 && ${OSVERSION} < 500014
|
||||
IGNORE= "You need tar with bzip support to run portaudit"
|
||||
.if defined(BZIP2DEPENDS)
|
||||
RUN_DEPENDS+= bzip2:${PORTSDIR}/archivers/bzip2
|
||||
.endif
|
||||
|
||||
do-build:
|
||||
.for f in portaudit-cmd.sh portaudit.sh fetchaudit.sh portaudit.functions portaudit.1
|
||||
.for f in portaudit-cmd.sh portaudit.sh fetchaudit.sh portaudit.functions portaudit.1 portaudit.conf
|
||||
@${SED} -e "s|%%DATADIR%%|${DATADIR}|g" \
|
||||
-e "s|%%DATABASEDIR%%|${DATABASEDIR}|g" \
|
||||
-e "s|%%PREFIX%%|${PREFIX}|g" \
|
||||
-e "s|%%LOCALBASE%%|${LOCALBASE}|g" \
|
||||
-e "s|%%PORTVERSION%%|${PORTVERSION}|g" \
|
||||
-e "s|%%BZIP2_CMD%%|${BZIP2_CMD}|g" \
|
||||
${FILESDIR}/${f} > ${WRKDIR}/${f}
|
||||
.endfor
|
||||
|
||||
@ -66,6 +67,7 @@ do-install:
|
||||
@${INSTALL_SCRIPT} ${WRKDIR}/fetchaudit.sh ${PERIODICDIR}/daily/330.fetchaudit
|
||||
@${MKDIR} ${DATADIR}
|
||||
@${INSTALL_DATA} ${WRKDIR}/portaudit.functions ${DATADIR}
|
||||
@${INSTALL_DATA} ${WRKDIR}/portaudit.conf ${PREFIX}/etc/portaudit.conf.sample
|
||||
@${MKDIR} ${DATABASEDIR}
|
||||
|
||||
post-install:
|
||||
|
||||
@ -34,34 +34,57 @@
|
||||
. %%DATADIR%%/portaudit.functions
|
||||
portaudit_confs
|
||||
|
||||
opt_audit=false
|
||||
opt_version=false
|
||||
opt_dbversion=false
|
||||
opt_fetch=false
|
||||
opt_quiet=false
|
||||
|
||||
if [ $# -eq 0 ] ; then
|
||||
opt_audit=true
|
||||
fi
|
||||
|
||||
while getopts aVdFq opt; do
|
||||
case "$opt" in
|
||||
a)
|
||||
opt_audit=true;;
|
||||
d)
|
||||
opt_dbversion=true;;
|
||||
F)
|
||||
opt_fetch=true;;
|
||||
q)
|
||||
opt_quiet=true;;
|
||||
V)
|
||||
opt_version=true;;
|
||||
?)
|
||||
echo "Usage: $0 -adFqV"
|
||||
exit 2;;
|
||||
esac
|
||||
done
|
||||
|
||||
shift $(($OPTIND - 1))
|
||||
|
||||
if $opt_version; then
|
||||
echo "portaudit version %%PORTVERSION%%"
|
||||
fi
|
||||
|
||||
if $opt_fetch; then
|
||||
fetch_auditfile || echo "failed."
|
||||
fi
|
||||
|
||||
if $opt_dbversion; then
|
||||
if [ ! -f "${portaudit_dir}/${portaudit_filename}" ]; then
|
||||
echo "portaudit: database missing. run \`portaudit -F' to update."
|
||||
exit 2
|
||||
fi
|
||||
if ! checksum_auditfile; then
|
||||
echo "portaudit: database corrupt."
|
||||
exit 2
|
||||
fi
|
||||
echo "database created: `getcreated_auditfile`"
|
||||
fi
|
||||
|
||||
if $opt_audit; then
|
||||
portaudit_prerequisites
|
||||
audit_installed || true
|
||||
fi
|
||||
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
-a)
|
||||
portaudit_prerequisites
|
||||
audit_installed || true
|
||||
;;
|
||||
-V)
|
||||
echo "portaudit version %%PORTVERSION%%"
|
||||
;;
|
||||
-d)
|
||||
if [ ! -f "${portaudit_dir}/${portaudit_filename}" ]; then
|
||||
echo "portaudit: database missing. run \`portaudit -F' to update."
|
||||
exit 2
|
||||
fi
|
||||
if ! checksum_auditfile; then
|
||||
echo "portaudit: database corrupt."
|
||||
exit 2
|
||||
fi
|
||||
echo "database created: `getcreated_auditfile`"
|
||||
;;
|
||||
-F)
|
||||
fetch_auditfile || echo "failed."
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd February 21, 2004
|
||||
.Dd March 11, 2004
|
||||
.Os FreeBSD
|
||||
.Dt PORTAUDIT \&1 "FreeBSD ports collection"
|
||||
.
|
||||
@ -60,12 +60,12 @@ to check if security advisories for any installed packages exist. Note that a
|
||||
current ports tree (or any local copy of the ports tree) is not required for
|
||||
operation.
|
||||
.Pp
|
||||
This package also installs two scripts into %%PREFIX%%/periodic that regularly
|
||||
update this database and include the report of vulnerable packages in the
|
||||
daily security report.
|
||||
This package also installs two scripts into %%PREFIX%%/etc/periodic that
|
||||
regularly update this database and include the report of vulnerable packages
|
||||
in the daily security report.
|
||||
.Pp
|
||||
If you have a vulnerable package installed, you are advised to update or
|
||||
deinstalled it immediately.
|
||||
deinstall it immediately.
|
||||
.
|
||||
.
|
||||
.Sh OPTIONS
|
||||
@ -110,15 +110,16 @@ Print a vulnerability report for all installed packages:
|
||||
.Xr ports 7 ,
|
||||
.Xr periodic 8 ,
|
||||
.Xr periodic.conf 5 ,
|
||||
.Li Aq http://www.freebsd.org/security/#adv .
|
||||
.Li Aq http://people.freebsd.org/~eik/portaudit/ ,
|
||||
.Li Aq http://www.freebsd.org/security/#adv ,
|
||||
.Li Aq http://www.vuxml.org/ .
|
||||
.
|
||||
.
|
||||
.Sh CAVEATS
|
||||
.
|
||||
.Nm
|
||||
is in develpoment and should currently not be relied upon
|
||||
as an extensive security auditing tool.
|
||||
The format of
|
||||
.Pa %%DATABASEDIR%%/auditfile.tbz
|
||||
might change.
|
||||
.
|
||||
.
|
||||
.Sh BUGS
|
||||
|
||||
24
ports-mgmt/portaudit/files/portaudit.conf
Normal file
24
ports-mgmt/portaudit/files/portaudit.conf
Normal file
@ -0,0 +1,24 @@
|
||||
#
|
||||
# Sample configuration file for portaudit(1)
|
||||
#
|
||||
# copy to %%PREFIX%%/etc/portaudit.conf
|
||||
#
|
||||
# $FreeBSD$
|
||||
#
|
||||
|
||||
# specify a proxy if needed, see fetch(3)
|
||||
#FETCH_ENV="FTP_PROXY=http://ftp.proxy.sample/ HTTP_PROXY=http://http.proxy.sample:80/"
|
||||
|
||||
# default fetch command
|
||||
#FETCH_CMD="/usr/bin/fetch -1am"
|
||||
|
||||
# uncoment to use passive ftp, see fetch(1)
|
||||
#FETCH_BEFORE_ARGS="-p"
|
||||
|
||||
#FETCH_AFTER_ARGS=
|
||||
|
||||
# specify a local mirror here
|
||||
#MASTER_SITES="http://my.mirror.sample/path/portaudit/"
|
||||
|
||||
# uncomment to prefer the UK mirror, jp, se, tw and uk are available
|
||||
#MASTER_SORT_REGEX="\.uk[.\/]"
|
||||
@ -36,25 +36,29 @@ portaudit_confs()
|
||||
portaudit_dir=${portaudit_dir:-"%%DATABASEDIR%%"}
|
||||
portaudit_filename=${portaudit_filename:-"auditfile.tbz"}
|
||||
|
||||
FETCH_ENV=
|
||||
FETCH_CMD="fetch -1am"
|
||||
FETCH_BEFORE_ARGS=
|
||||
FETCH_AFTER_ARGS=
|
||||
FETCH_ENV=${FETCH_ENV:-}
|
||||
FETCH_CMD=${FETCH_CMD:-"/usr/bin/fetch -1am"}
|
||||
FETCH_BEFORE_ARGS=${FETCH_BEFORE_ARGS:-}
|
||||
FETCH_AFTER_ARGS=${FETCH_AFTER_ARGS:-}
|
||||
|
||||
MASTER_SITE_LOCAL="
|
||||
${MASTER_SITE_LOCAL}
|
||||
MASTER_SITES=${MASTER_SITES:-"
|
||||
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.se.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.dk.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.cz.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp1.ro.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.uk.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.ru.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.at.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.jp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.tw.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
"
|
||||
http://public.planetmirror.com/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
"}
|
||||
MASTER_SITE_SUBDIR=${MASTER_SITE_SUBDIR:-"eik"}
|
||||
|
||||
MASTER_SITE_SUBDIR=eik
|
||||
MASTER_SITE_BACKUP=${MASTER_SITE_BACKUP:-"http://people.freebsd.org/~eik/portaudit/"}
|
||||
|
||||
#MASTER_SORT_REGEX="\.uk[.\/]"
|
||||
MASTER_SORT_REGEX="#"
|
||||
MASTER_SORT_REGEX=${MASTER_SORT_REGEX:-"#"}
|
||||
|
||||
if [ -r %%PREFIX%%/etc/portaudit.conf ]; then
|
||||
. %%PREFIX%%/etc/portaudit.conf
|
||||
@ -63,27 +67,28 @@ portaudit_confs()
|
||||
|
||||
extract_auditfile()
|
||||
{
|
||||
tar -jxOf "${portaudit_dir}/${portaudit_filename}" auditfile
|
||||
%%BZIP2_CMD%% -dc -- "${portaudit_dir}/${portaudit_filename}" | \
|
||||
/usr/bin/tar -xOf - auditfile
|
||||
}
|
||||
|
||||
checksum_auditfile()
|
||||
{
|
||||
chksum1=`extract_auditfile |
|
||||
sed -nEe '$s/^#CHECKSUM: *MD5 *([0-9a-f]{32})$/\1/p'`
|
||||
chksum2=`extract_auditfile | sed -e '$d' | md5`
|
||||
/usr/bin/sed -nEe '$s/^#CHECKSUM: *MD5 *([0-9a-f]{32})$/\1/p'`
|
||||
chksum2=`extract_auditfile | /usr/bin/sed -e '$d' | /sbin/md5`
|
||||
[ "${chksum1}" = "${chksum2}" ];
|
||||
}
|
||||
|
||||
getcreated_auditfile()
|
||||
{
|
||||
extract_auditfile |
|
||||
sed -nEe '1s/^#CREATED: *([0-9]{4})-?([0-9]{2})-?([0-9]{2}).*$/\1\2\3/p'
|
||||
/usr/bin/sed -nEe '1s/^#CREATED: *([0-9]{4})-?([0-9]{2})-?([0-9]{2}).*$/\1\2\3/p'
|
||||
}
|
||||
|
||||
checkexpiry_auditfile()
|
||||
{
|
||||
created=`getcreated_auditfile`
|
||||
expiry=`date -u -v-$1d '+%Y%m%d'`
|
||||
expiry=`/bin/date -u -v-$1d '+%Y%m%d'`
|
||||
[ "${created}" -ge "${expiry}" ];
|
||||
}
|
||||
|
||||
@ -126,7 +131,7 @@ portaudit_prerequisites()
|
||||
|
||||
audit_installed()
|
||||
{
|
||||
extract_auditfile | awk -F\| "
|
||||
extract_auditfile | /usr/bin/awk -F\| "
|
||||
BEGIN { vul=0 }
|
||||
/^(#|\$)/ { next }
|
||||
{
|
||||
@ -153,15 +158,18 @@ audit_installed()
|
||||
fetch_locations()
|
||||
{
|
||||
# site sort order is not overly smart
|
||||
echo "${MASTER_SITE_LOCAL}" | sed -e 'y/ /\n\n/' | awk "
|
||||
echo ${MASTER_SITES} | /usr/bin/tr -s ' \t' '\n' | /usr/bin/awk "
|
||||
BEGIN { IGNORECASE=1; srand() }
|
||||
/^$/ { next }
|
||||
{
|
||||
if (\$0 ~ /${MASTER_SORT_REGEX}/ ) rank=0; else rank=rand()
|
||||
gsub(/%SUBDIR%/, \"${MASTER_SITE_SUBDIR}\")
|
||||
print rank \"\\t\" \$0
|
||||
print \$0 \"\\t\" rank
|
||||
}
|
||||
" | sort -n | cut -f 2
|
||||
" | /usr/bin/sort -n -k 2 | /usr/bin/cut -f 1
|
||||
if [ -n "${MASTER_SITE_BACKUP}" ]; then
|
||||
echo "${MASTER_SITE_BACKUP}"
|
||||
fi
|
||||
}
|
||||
|
||||
fetch_auditfile()
|
||||
@ -169,22 +177,25 @@ fetch_auditfile()
|
||||
rc=1
|
||||
|
||||
if [ ! -d "${portaudit_dir}" ]; then
|
||||
mkdir -p "${portaudit_dir}"
|
||||
if ! /bin/mkdir -p "${portaudit_dir}"; then
|
||||
echo "Couldn't create ${portaudit_dir}, try running portaudit -F as root"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
if [ ! -w "${portaudit_dir}" ]; then
|
||||
echo "Couldn't write to ${portaudit_dir}"
|
||||
echo "Couldn't write to ${portaudit_dir}, try running portaudit -F as root"
|
||||
return 1
|
||||
|
||||
fi
|
||||
cd "${portaudit_dir}"
|
||||
if [ -r "${portaudit_filename}" ]; then
|
||||
cp "${portaudit_filename}" "${portaudit_filename}.old"
|
||||
/bin/cp "${portaudit_filename}" "${portaudit_filename}.old"
|
||||
fi
|
||||
|
||||
for site in `fetch_locations`; do
|
||||
echo ">> Attempting to fetch from ${site}."
|
||||
args="${site}/${portaudit_filename}"
|
||||
env ${FETCH_ENV} ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${args} ${FETCH_AFTER_ARGS}
|
||||
args="${site}${portaudit_filename}"
|
||||
/usr/bin/env ${FETCH_ENV} ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${args} ${FETCH_AFTER_ARGS}
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Couldn't fetch database."
|
||||
elif [ ! -f "${portaudit_dir}/${portaudit_filename}" ] ; then
|
||||
@ -193,6 +204,7 @@ fetch_auditfile()
|
||||
echo "fetched database corrupt."
|
||||
elif ! checkexpiry_auditfile 7; then
|
||||
echo "fetched database too old."
|
||||
rc=0
|
||||
else
|
||||
echo "new database installed."
|
||||
rc=0
|
||||
@ -201,12 +213,14 @@ fetch_auditfile()
|
||||
done
|
||||
if [ -f "${portaudit_filename}.old" ]; then
|
||||
if [ ${rc} -eq 0 ]; then
|
||||
rm -f "${portaudit_filename}.old"
|
||||
/bin/rm -f "${portaudit_filename}.old"
|
||||
else
|
||||
mv -f "${portaudit_filename}.old" "${portaudit_filename}"
|
||||
/bin/mv -f "${portaudit_filename}.old" "${portaudit_filename}"
|
||||
echo "old database restored."
|
||||
fi
|
||||
fi
|
||||
chmod a=r "${portaudit_filename}"
|
||||
if [ -f "${portaudit_filename}" ]; then
|
||||
/bin/chmod a=r "${portaudit_filename}"
|
||||
fi
|
||||
return ${rc}
|
||||
}
|
||||
|
||||
@ -3,16 +3,15 @@
|
||||
# $FreeBSD$
|
||||
#
|
||||
|
||||
ECHO_CMD=echo
|
||||
|
||||
case $2 in
|
||||
POST-DEINSTALL)
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} "The portaudit package has been deleted."
|
||||
${ECHO_CMD} "If you're *not* upgrading and won't be using"
|
||||
${ECHO_CMD} "it any longer, you may want to remove the"
|
||||
${ECHO_CMD} "portaudit database:"
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} " rm -Rf %%DATABASEDIR%%"
|
||||
echo
|
||||
echo "The portaudit package has been deleted."
|
||||
echo "If you're *not* upgrading and won't be using"
|
||||
echo "it any longer, you may want to remove the"
|
||||
echo "portaudit database:"
|
||||
echo
|
||||
echo " rm -Rf %%DATABASEDIR%%"
|
||||
echo
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -4,9 +4,6 @@ database of published security vulnerabilities.
|
||||
After installation it will update this security database automatically and
|
||||
include its reports in the output of the daily security run.
|
||||
|
||||
Since this system is in development it can currently not be relied upon as an
|
||||
extensive security auditing tool.
|
||||
|
||||
If you have found a vulnerability not listed in the database, please contact
|
||||
the FreeBSD Security Officer <security-officer@FreeBSD.org>. Refer to
|
||||
|
||||
@ -14,6 +11,6 @@ the FreeBSD Security Officer <security-officer@FreeBSD.org>. Refer to
|
||||
|
||||
for more information.
|
||||
|
||||
WWW: http://sourceforge.net/projects/portaudit/
|
||||
WWW: http://people.freebsd.org/~eik/portaudit/
|
||||
|
||||
Oliver Eikemeier <eik@FreeBSD.org>
|
||||
|
||||
@ -3,16 +3,14 @@
|
||||
# $FreeBSD$
|
||||
#
|
||||
|
||||
ECHO_CMD=echo
|
||||
|
||||
case $2 in
|
||||
POST-INSTALL)
|
||||
if [ ! -f "%%DATABASEDIR%%/auditfile.tbz" ]; then
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} "===> To check your installed ports for known vulnerabilities now do:"
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} " %%PREFIX%%/bin/portaudit -F -a"
|
||||
${ECHO_CMD}
|
||||
echo
|
||||
echo "===> To check your installed ports for known vulnerabilities now do:"
|
||||
echo
|
||||
echo " %%PREFIX%%/bin/portaudit -F -a"
|
||||
echo
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -1,4 +1,5 @@
|
||||
bin/portaudit
|
||||
etc/portaudit.conf.sample
|
||||
%%PERIODICDIR%%/security/910.portaudit
|
||||
%%PERIODICDIR%%/daily/330.fetchaudit
|
||||
%%DATADIR%%/portaudit.functions
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
PORTNAME= portaudit
|
||||
PORTVERSION= 0.2.1
|
||||
PORTVERSION= 0.3
|
||||
CATEGORIES= security
|
||||
DISTFILES=
|
||||
|
||||
@ -36,17 +36,18 @@ RUN_DEPENDS= ${LOCALBASE}/sbin/pkg_info:${PORTSDIR}/sysutils/pkg_install-devel
|
||||
|
||||
.include <bsd.port.pre.mk>
|
||||
|
||||
.if ${OSVERSION} < 420001 || ${OSVERSION} >= 500000 && ${OSVERSION} < 500014
|
||||
IGNORE= "You need tar with bzip support to run portaudit"
|
||||
.if defined(BZIP2DEPENDS)
|
||||
RUN_DEPENDS+= bzip2:${PORTSDIR}/archivers/bzip2
|
||||
.endif
|
||||
|
||||
do-build:
|
||||
.for f in portaudit-cmd.sh portaudit.sh fetchaudit.sh portaudit.functions portaudit.1
|
||||
.for f in portaudit-cmd.sh portaudit.sh fetchaudit.sh portaudit.functions portaudit.1 portaudit.conf
|
||||
@${SED} -e "s|%%DATADIR%%|${DATADIR}|g" \
|
||||
-e "s|%%DATABASEDIR%%|${DATABASEDIR}|g" \
|
||||
-e "s|%%PREFIX%%|${PREFIX}|g" \
|
||||
-e "s|%%LOCALBASE%%|${LOCALBASE}|g" \
|
||||
-e "s|%%PORTVERSION%%|${PORTVERSION}|g" \
|
||||
-e "s|%%BZIP2_CMD%%|${BZIP2_CMD}|g" \
|
||||
${FILESDIR}/${f} > ${WRKDIR}/${f}
|
||||
.endfor
|
||||
|
||||
@ -66,6 +67,7 @@ do-install:
|
||||
@${INSTALL_SCRIPT} ${WRKDIR}/fetchaudit.sh ${PERIODICDIR}/daily/330.fetchaudit
|
||||
@${MKDIR} ${DATADIR}
|
||||
@${INSTALL_DATA} ${WRKDIR}/portaudit.functions ${DATADIR}
|
||||
@${INSTALL_DATA} ${WRKDIR}/portaudit.conf ${PREFIX}/etc/portaudit.conf.sample
|
||||
@${MKDIR} ${DATABASEDIR}
|
||||
|
||||
post-install:
|
||||
|
||||
@ -34,34 +34,57 @@
|
||||
. %%DATADIR%%/portaudit.functions
|
||||
portaudit_confs
|
||||
|
||||
opt_audit=false
|
||||
opt_version=false
|
||||
opt_dbversion=false
|
||||
opt_fetch=false
|
||||
opt_quiet=false
|
||||
|
||||
if [ $# -eq 0 ] ; then
|
||||
opt_audit=true
|
||||
fi
|
||||
|
||||
while getopts aVdFq opt; do
|
||||
case "$opt" in
|
||||
a)
|
||||
opt_audit=true;;
|
||||
d)
|
||||
opt_dbversion=true;;
|
||||
F)
|
||||
opt_fetch=true;;
|
||||
q)
|
||||
opt_quiet=true;;
|
||||
V)
|
||||
opt_version=true;;
|
||||
?)
|
||||
echo "Usage: $0 -adFqV"
|
||||
exit 2;;
|
||||
esac
|
||||
done
|
||||
|
||||
shift $(($OPTIND - 1))
|
||||
|
||||
if $opt_version; then
|
||||
echo "portaudit version %%PORTVERSION%%"
|
||||
fi
|
||||
|
||||
if $opt_fetch; then
|
||||
fetch_auditfile || echo "failed."
|
||||
fi
|
||||
|
||||
if $opt_dbversion; then
|
||||
if [ ! -f "${portaudit_dir}/${portaudit_filename}" ]; then
|
||||
echo "portaudit: database missing. run \`portaudit -F' to update."
|
||||
exit 2
|
||||
fi
|
||||
if ! checksum_auditfile; then
|
||||
echo "portaudit: database corrupt."
|
||||
exit 2
|
||||
fi
|
||||
echo "database created: `getcreated_auditfile`"
|
||||
fi
|
||||
|
||||
if $opt_audit; then
|
||||
portaudit_prerequisites
|
||||
audit_installed || true
|
||||
fi
|
||||
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
-a)
|
||||
portaudit_prerequisites
|
||||
audit_installed || true
|
||||
;;
|
||||
-V)
|
||||
echo "portaudit version %%PORTVERSION%%"
|
||||
;;
|
||||
-d)
|
||||
if [ ! -f "${portaudit_dir}/${portaudit_filename}" ]; then
|
||||
echo "portaudit: database missing. run \`portaudit -F' to update."
|
||||
exit 2
|
||||
fi
|
||||
if ! checksum_auditfile; then
|
||||
echo "portaudit: database corrupt."
|
||||
exit 2
|
||||
fi
|
||||
echo "database created: `getcreated_auditfile`"
|
||||
;;
|
||||
-F)
|
||||
fetch_auditfile || echo "failed."
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd February 21, 2004
|
||||
.Dd March 11, 2004
|
||||
.Os FreeBSD
|
||||
.Dt PORTAUDIT \&1 "FreeBSD ports collection"
|
||||
.
|
||||
@ -60,12 +60,12 @@ to check if security advisories for any installed packages exist. Note that a
|
||||
current ports tree (or any local copy of the ports tree) is not required for
|
||||
operation.
|
||||
.Pp
|
||||
This package also installs two scripts into %%PREFIX%%/periodic that regularly
|
||||
update this database and include the report of vulnerable packages in the
|
||||
daily security report.
|
||||
This package also installs two scripts into %%PREFIX%%/etc/periodic that
|
||||
regularly update this database and include the report of vulnerable packages
|
||||
in the daily security report.
|
||||
.Pp
|
||||
If you have a vulnerable package installed, you are advised to update or
|
||||
deinstalled it immediately.
|
||||
deinstall it immediately.
|
||||
.
|
||||
.
|
||||
.Sh OPTIONS
|
||||
@ -110,15 +110,16 @@ Print a vulnerability report for all installed packages:
|
||||
.Xr ports 7 ,
|
||||
.Xr periodic 8 ,
|
||||
.Xr periodic.conf 5 ,
|
||||
.Li Aq http://www.freebsd.org/security/#adv .
|
||||
.Li Aq http://people.freebsd.org/~eik/portaudit/ ,
|
||||
.Li Aq http://www.freebsd.org/security/#adv ,
|
||||
.Li Aq http://www.vuxml.org/ .
|
||||
.
|
||||
.
|
||||
.Sh CAVEATS
|
||||
.
|
||||
.Nm
|
||||
is in develpoment and should currently not be relied upon
|
||||
as an extensive security auditing tool.
|
||||
The format of
|
||||
.Pa %%DATABASEDIR%%/auditfile.tbz
|
||||
might change.
|
||||
.
|
||||
.
|
||||
.Sh BUGS
|
||||
|
||||
24
security/portaudit/files/portaudit.conf
Normal file
24
security/portaudit/files/portaudit.conf
Normal file
@ -0,0 +1,24 @@
|
||||
#
|
||||
# Sample configuration file for portaudit(1)
|
||||
#
|
||||
# copy to %%PREFIX%%/etc/portaudit.conf
|
||||
#
|
||||
# $FreeBSD$
|
||||
#
|
||||
|
||||
# specify a proxy if needed, see fetch(3)
|
||||
#FETCH_ENV="FTP_PROXY=http://ftp.proxy.sample/ HTTP_PROXY=http://http.proxy.sample:80/"
|
||||
|
||||
# default fetch command
|
||||
#FETCH_CMD="/usr/bin/fetch -1am"
|
||||
|
||||
# uncoment to use passive ftp, see fetch(1)
|
||||
#FETCH_BEFORE_ARGS="-p"
|
||||
|
||||
#FETCH_AFTER_ARGS=
|
||||
|
||||
# specify a local mirror here
|
||||
#MASTER_SITES="http://my.mirror.sample/path/portaudit/"
|
||||
|
||||
# uncomment to prefer the UK mirror, jp, se, tw and uk are available
|
||||
#MASTER_SORT_REGEX="\.uk[.\/]"
|
||||
@ -36,25 +36,29 @@ portaudit_confs()
|
||||
portaudit_dir=${portaudit_dir:-"%%DATABASEDIR%%"}
|
||||
portaudit_filename=${portaudit_filename:-"auditfile.tbz"}
|
||||
|
||||
FETCH_ENV=
|
||||
FETCH_CMD="fetch -1am"
|
||||
FETCH_BEFORE_ARGS=
|
||||
FETCH_AFTER_ARGS=
|
||||
FETCH_ENV=${FETCH_ENV:-}
|
||||
FETCH_CMD=${FETCH_CMD:-"/usr/bin/fetch -1am"}
|
||||
FETCH_BEFORE_ARGS=${FETCH_BEFORE_ARGS:-}
|
||||
FETCH_AFTER_ARGS=${FETCH_AFTER_ARGS:-}
|
||||
|
||||
MASTER_SITE_LOCAL="
|
||||
${MASTER_SITE_LOCAL}
|
||||
MASTER_SITES=${MASTER_SITES:-"
|
||||
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.se.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.dk.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.cz.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp1.ro.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.uk.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.ru.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.at.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.jp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
ftp://ftp.tw.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
"
|
||||
http://public.planetmirror.com/pub/FreeBSD/ports/local-distfiles/%SUBDIR%/
|
||||
"}
|
||||
MASTER_SITE_SUBDIR=${MASTER_SITE_SUBDIR:-"eik"}
|
||||
|
||||
MASTER_SITE_SUBDIR=eik
|
||||
MASTER_SITE_BACKUP=${MASTER_SITE_BACKUP:-"http://people.freebsd.org/~eik/portaudit/"}
|
||||
|
||||
#MASTER_SORT_REGEX="\.uk[.\/]"
|
||||
MASTER_SORT_REGEX="#"
|
||||
MASTER_SORT_REGEX=${MASTER_SORT_REGEX:-"#"}
|
||||
|
||||
if [ -r %%PREFIX%%/etc/portaudit.conf ]; then
|
||||
. %%PREFIX%%/etc/portaudit.conf
|
||||
@ -63,27 +67,28 @@ portaudit_confs()
|
||||
|
||||
extract_auditfile()
|
||||
{
|
||||
tar -jxOf "${portaudit_dir}/${portaudit_filename}" auditfile
|
||||
%%BZIP2_CMD%% -dc -- "${portaudit_dir}/${portaudit_filename}" | \
|
||||
/usr/bin/tar -xOf - auditfile
|
||||
}
|
||||
|
||||
checksum_auditfile()
|
||||
{
|
||||
chksum1=`extract_auditfile |
|
||||
sed -nEe '$s/^#CHECKSUM: *MD5 *([0-9a-f]{32})$/\1/p'`
|
||||
chksum2=`extract_auditfile | sed -e '$d' | md5`
|
||||
/usr/bin/sed -nEe '$s/^#CHECKSUM: *MD5 *([0-9a-f]{32})$/\1/p'`
|
||||
chksum2=`extract_auditfile | /usr/bin/sed -e '$d' | /sbin/md5`
|
||||
[ "${chksum1}" = "${chksum2}" ];
|
||||
}
|
||||
|
||||
getcreated_auditfile()
|
||||
{
|
||||
extract_auditfile |
|
||||
sed -nEe '1s/^#CREATED: *([0-9]{4})-?([0-9]{2})-?([0-9]{2}).*$/\1\2\3/p'
|
||||
/usr/bin/sed -nEe '1s/^#CREATED: *([0-9]{4})-?([0-9]{2})-?([0-9]{2}).*$/\1\2\3/p'
|
||||
}
|
||||
|
||||
checkexpiry_auditfile()
|
||||
{
|
||||
created=`getcreated_auditfile`
|
||||
expiry=`date -u -v-$1d '+%Y%m%d'`
|
||||
expiry=`/bin/date -u -v-$1d '+%Y%m%d'`
|
||||
[ "${created}" -ge "${expiry}" ];
|
||||
}
|
||||
|
||||
@ -126,7 +131,7 @@ portaudit_prerequisites()
|
||||
|
||||
audit_installed()
|
||||
{
|
||||
extract_auditfile | awk -F\| "
|
||||
extract_auditfile | /usr/bin/awk -F\| "
|
||||
BEGIN { vul=0 }
|
||||
/^(#|\$)/ { next }
|
||||
{
|
||||
@ -153,15 +158,18 @@ audit_installed()
|
||||
fetch_locations()
|
||||
{
|
||||
# site sort order is not overly smart
|
||||
echo "${MASTER_SITE_LOCAL}" | sed -e 'y/ /\n\n/' | awk "
|
||||
echo ${MASTER_SITES} | /usr/bin/tr -s ' \t' '\n' | /usr/bin/awk "
|
||||
BEGIN { IGNORECASE=1; srand() }
|
||||
/^$/ { next }
|
||||
{
|
||||
if (\$0 ~ /${MASTER_SORT_REGEX}/ ) rank=0; else rank=rand()
|
||||
gsub(/%SUBDIR%/, \"${MASTER_SITE_SUBDIR}\")
|
||||
print rank \"\\t\" \$0
|
||||
print \$0 \"\\t\" rank
|
||||
}
|
||||
" | sort -n | cut -f 2
|
||||
" | /usr/bin/sort -n -k 2 | /usr/bin/cut -f 1
|
||||
if [ -n "${MASTER_SITE_BACKUP}" ]; then
|
||||
echo "${MASTER_SITE_BACKUP}"
|
||||
fi
|
||||
}
|
||||
|
||||
fetch_auditfile()
|
||||
@ -169,22 +177,25 @@ fetch_auditfile()
|
||||
rc=1
|
||||
|
||||
if [ ! -d "${portaudit_dir}" ]; then
|
||||
mkdir -p "${portaudit_dir}"
|
||||
if ! /bin/mkdir -p "${portaudit_dir}"; then
|
||||
echo "Couldn't create ${portaudit_dir}, try running portaudit -F as root"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
if [ ! -w "${portaudit_dir}" ]; then
|
||||
echo "Couldn't write to ${portaudit_dir}"
|
||||
echo "Couldn't write to ${portaudit_dir}, try running portaudit -F as root"
|
||||
return 1
|
||||
|
||||
fi
|
||||
cd "${portaudit_dir}"
|
||||
if [ -r "${portaudit_filename}" ]; then
|
||||
cp "${portaudit_filename}" "${portaudit_filename}.old"
|
||||
/bin/cp "${portaudit_filename}" "${portaudit_filename}.old"
|
||||
fi
|
||||
|
||||
for site in `fetch_locations`; do
|
||||
echo ">> Attempting to fetch from ${site}."
|
||||
args="${site}/${portaudit_filename}"
|
||||
env ${FETCH_ENV} ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${args} ${FETCH_AFTER_ARGS}
|
||||
args="${site}${portaudit_filename}"
|
||||
/usr/bin/env ${FETCH_ENV} ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${args} ${FETCH_AFTER_ARGS}
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Couldn't fetch database."
|
||||
elif [ ! -f "${portaudit_dir}/${portaudit_filename}" ] ; then
|
||||
@ -193,6 +204,7 @@ fetch_auditfile()
|
||||
echo "fetched database corrupt."
|
||||
elif ! checkexpiry_auditfile 7; then
|
||||
echo "fetched database too old."
|
||||
rc=0
|
||||
else
|
||||
echo "new database installed."
|
||||
rc=0
|
||||
@ -201,12 +213,14 @@ fetch_auditfile()
|
||||
done
|
||||
if [ -f "${portaudit_filename}.old" ]; then
|
||||
if [ ${rc} -eq 0 ]; then
|
||||
rm -f "${portaudit_filename}.old"
|
||||
/bin/rm -f "${portaudit_filename}.old"
|
||||
else
|
||||
mv -f "${portaudit_filename}.old" "${portaudit_filename}"
|
||||
/bin/mv -f "${portaudit_filename}.old" "${portaudit_filename}"
|
||||
echo "old database restored."
|
||||
fi
|
||||
fi
|
||||
chmod a=r "${portaudit_filename}"
|
||||
if [ -f "${portaudit_filename}" ]; then
|
||||
/bin/chmod a=r "${portaudit_filename}"
|
||||
fi
|
||||
return ${rc}
|
||||
}
|
||||
|
||||
@ -3,16 +3,15 @@
|
||||
# $FreeBSD$
|
||||
#
|
||||
|
||||
ECHO_CMD=echo
|
||||
|
||||
case $2 in
|
||||
POST-DEINSTALL)
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} "The portaudit package has been deleted."
|
||||
${ECHO_CMD} "If you're *not* upgrading and won't be using"
|
||||
${ECHO_CMD} "it any longer, you may want to remove the"
|
||||
${ECHO_CMD} "portaudit database:"
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} " rm -Rf %%DATABASEDIR%%"
|
||||
echo
|
||||
echo "The portaudit package has been deleted."
|
||||
echo "If you're *not* upgrading and won't be using"
|
||||
echo "it any longer, you may want to remove the"
|
||||
echo "portaudit database:"
|
||||
echo
|
||||
echo " rm -Rf %%DATABASEDIR%%"
|
||||
echo
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -4,9 +4,6 @@ database of published security vulnerabilities.
|
||||
After installation it will update this security database automatically and
|
||||
include its reports in the output of the daily security run.
|
||||
|
||||
Since this system is in development it can currently not be relied upon as an
|
||||
extensive security auditing tool.
|
||||
|
||||
If you have found a vulnerability not listed in the database, please contact
|
||||
the FreeBSD Security Officer <security-officer@FreeBSD.org>. Refer to
|
||||
|
||||
@ -14,6 +11,6 @@ the FreeBSD Security Officer <security-officer@FreeBSD.org>. Refer to
|
||||
|
||||
for more information.
|
||||
|
||||
WWW: http://sourceforge.net/projects/portaudit/
|
||||
WWW: http://people.freebsd.org/~eik/portaudit/
|
||||
|
||||
Oliver Eikemeier <eik@FreeBSD.org>
|
||||
|
||||
@ -3,16 +3,14 @@
|
||||
# $FreeBSD$
|
||||
#
|
||||
|
||||
ECHO_CMD=echo
|
||||
|
||||
case $2 in
|
||||
POST-INSTALL)
|
||||
if [ ! -f "%%DATABASEDIR%%/auditfile.tbz" ]; then
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} "===> To check your installed ports for known vulnerabilities now do:"
|
||||
${ECHO_CMD}
|
||||
${ECHO_CMD} " %%PREFIX%%/bin/portaudit -F -a"
|
||||
${ECHO_CMD}
|
||||
echo
|
||||
echo "===> To check your installed ports for known vulnerabilities now do:"
|
||||
echo
|
||||
echo " %%PREFIX%%/bin/portaudit -F -a"
|
||||
echo
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -1,4 +1,5 @@
|
||||
bin/portaudit
|
||||
etc/portaudit.conf.sample
|
||||
%%PERIODICDIR%%/security/910.portaudit
|
||||
%%PERIODICDIR%%/daily/330.fetchaudit
|
||||
%%DATADIR%%/portaudit.functions
|
||||
|
||||
Loading…
Reference in New Issue
Block a user