Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Security is a major concern. Every major Linux distribution uses signed packages. But the FreeBSD systems in the office downloading unsigned packages/ports via FTP.

Is there a solution that would allow me to securely update a *BSD on a malicious network?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Use freebsd-update for official binary system updates.
When you upgrade packages from ports (e.g. with "portsnap" and "portmaster" like I do) the packages' source-files ARE signed with SHA256 checksums and verified before compilation, so I wouldn't worry about that.
Since it seems you're very much security-aware, I'd go with compiling ports from signed sources if I were you anyway.

share|improve this answer
    
+1 Yep, almost every update mechanism uses SHA256 and/or MD5 checksums to ensure packages and source files are correctly fetched. –  Chris S May 25 '11 at 20:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.