Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Security is a major concern. Every major Linux distribution uses signed packages. But the FreeBSD systems in the office downloading unsigned packages/ports via FTP.

Is there a solution that would allow me to securely update a *BSD on a malicious network?

share|improve this question
up vote 6 down vote accepted

Use freebsd-update for official binary system updates.
When you upgrade packages from ports (e.g. with "portsnap" and "portmaster" like I do) the packages' source-files ARE signed with SHA256 checksums and verified before compilation, so I wouldn't worry about that.
Since it seems you're very much security-aware, I'd go with compiling ports from signed sources if I were you anyway.

share|improve this answer
+1 Yep, almost every update mechanism uses SHA256 and/or MD5 checksums to ensure packages and source files are correctly fetched. – Chris S May 25 '11 at 20:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.