4

Security is a major concern. Every major Linux distribution uses signed packages. But the FreeBSD systems in the office downloading unsigned packages/ports via FTP.

Is there a solution that would allow me to securely update a *BSD on a malicious network?

1 Answer 1

6

Use freebsd-update for official binary system updates.
When you upgrade packages from ports (e.g. with "portsnap" and "portmaster" like I do) the packages' source-files ARE signed with SHA256 checksums and verified before compilation, so I wouldn't worry about that.
Since it seems you're very much security-aware, I'd go with compiling ports from signed sources if I were you anyway.

1
  • +1 Yep, almost every update mechanism uses SHA256 and/or MD5 checksums to ensure packages and source files are correctly fetched.
    – Chris S
    May 25, 2011 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .