Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

glsa-check is a tool to report a server's exposure to known security vulnerabilities. Has anyone written a tool to do a similar thing for apt based systems?

share|improve this question
up vote 1 down vote accepted

Check the Security HOWTO for Debian which refers to vulnerability scanners like Nessus. While not as Free as it used to be, Nessus is still considered the #1 tool for UNIX vulnerability scanning.

If you have the security repository for Debian or Ubuntu installed, you can apt-get upgrade to that without fear of installing new packages, and safe in the knowledge that (as much as the Debian/Ubuntu maintainers are on the case) you will get patched packages at the version that you chose to install.

Some people choose to automatically 'apt-get update; apt-get upgrade -y' if they are only using security; your mileage may vary.

share|improve this answer

Nessus can do an external scans and will pick up on any problems it knows about with anything it finds listening on a port. However unless you use the Unix compliance (needs a professional nessus feed) module you can't check what is actually installed on the scanned host. By default it's pretty good with RedHat and will give you a list of packages that have had redhat advisories issued. AFAIK it doesn't to the same for Debian based systems, so it would need someone to write and maintain a plugin or nessus audit file that cross references DSA or CVE.

share|improve this answer

GLSA is not a network vulnerability scanner as Geoff rightfully pointed, it's only a little script comparing the versions of emerged ebuilds against a list of vulnerabilites affecting official gentoo ebuilds. See here for details:

Nessus on the other way only checks a system from the point of view of the network, not locally and as such cannot find vulnerabilities like local root exploits.

I don't know of an equivalent in Debian but if you feel ok developing your own script have a look here: Debian Security Bug Tracker, Debian Security main page and the associated feed of vulnerabilities.

share|improve this answer

  • Debian: debsecan
  • CentOS, Fedora, Redhat: "yum list-security"
  • OpenSuSE: "zypper list-patches"
  • SLES: "rug lu"
  • Gentoo: glsa-check
  • FreeBSD: Portaudit
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.