Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there way to find all non-ports installations in FreeBSD? I'm using 8.4 version.

Update:

I need this for audit installed binaries for system "trusted" versions.

share|improve this question
    
You can write a script which would exclude files from ports and base os ;) But you probably face different problem, right? How to audit binaries located on a server are "trusted" (base os or from ports). Then think about some kind of deployment and tools like aide, mtree etc. –  Jiri Xichtkniha Oct 14 '13 at 10:56
    
Yes, you're right. I need to audit installed binaries. Updated my question. –  Alexander Yancharuk Oct 14 '13 at 11:06
    
Then my first comment is valid ;) As you didn't have anything setup before the problem appeared, you have to write something yourself. But mtree saves you time. I would install same version and same ports on clean machine, run mtree (but you have to include /usr/local into mtree settings) to build DB with signatures and then compare it on problematic server. Try to check 'Use mtree as Built-in tripwire' in BSD hacks book. –  Jiri Xichtkniha Oct 14 '13 at 11:23
    
Your answer assumes that i need to install clean FreeBSD and install all soft. I want to find more elegant solution, if this possible. Also, if binaries was compiled with non-standard make settings, i think mtree signatures will be different even if binary version is system "trusted". –  Alexander Yancharuk Oct 14 '13 at 11:43
    
So can you tell me how can you compare it if you do not have any 'trusted' machine or db with signatures? Seems like chicken and egg problem :D –  Jiri Xichtkniha Oct 14 '13 at 13:07

1 Answer 1

up vote 2 down vote accepted

If you need to audit an already running server then you first have to think how to get similar setup to build a trusted base for your comparison. You can install same OS version to a test machine and build a checksum DB with tools like mtree, aide etc. Then you can install 3rd party software from OS packaging system and run checksum on these new files. As you would have trusted DB with signatures, you can get same signatures on your server being audited. Then compare the results.

Creating such signatures DB should be part of post-installation steps. After base OS installation from trusted media, create a DB with signatures. If you would use a deployment system like cfengine, puppet, chef etc. you can automatize such activities. Also such tools have such auditing features built-in (comparing files' checksums).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.