DaemonForums  

Go Back   DaemonForums > NetBSD > NetBSD Package System (pkgsrc)

NetBSD Package System (pkgsrc) Installation and upgrading of packages on NetBSD.

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 1st June 2013
pawaan pawaan is offline
Fdisk Soldier
 
Join Date: Jan 2013
Posts: 82
Default fetching package vulnerabilities from another server

Hi ! I have a question please : 'pkg_admin fetch-pkg-vulnerabilities' is irresponsive.Can I set ftp site other than the main site for pkg_admin ? sort of MASTER_SITE_OVERRIDE.
Reply With Quote
  #2   (View Single Post)  
Old 1st June 2013
shep shep is offline
Real Name: Scott
Arp Constable
 
Join Date: May 2008
Location: Dry and Dusty
Posts: 1,503
Default

I am not a seasoned NetBSD user but I believe that the ftp site is set by your
Code:
PKG_PATH
Once pkgsrc is running and the pkg-vulnerabilities warning appears, I copy/paste it into another root terminal to run. That way I know the pkg-vulnerabilities are for the collection of packages (2012Q4 vs 2013Q1) that I am using.
I typically set the PKG_PATH in my /usr/home/user/.profile
Reply With Quote
  #3   (View Single Post)  
Old 2nd June 2013
pawaan pawaan is offline
Fdisk Soldier
 
Join Date: Jan 2013
Posts: 82
Default

Thanks shep but seems like only NetBSD main server is dedicated to vulnerability checking even after you override it for pkgsrc in mk.conf.wrong ?
Reply With Quote
  #4   (View Single Post)  
Old 2nd June 2013
shep shep is offline
Real Name: Scott
Arp Constable
 
Join Date: May 2008
Location: Dry and Dusty
Posts: 1,503
Default

I do not have a NetBSD install at this time but typically the main server is mirrored.
I ftp'd the site (the url in FAQ is incorrect, it should be ftp://ftp.NetBSD.org/pub/pkgsrc/dist...ulnerabilities) and the file exits.
Quote:
9.14. Automated security checks

Please be aware that there can often be bugs in third-party software, and some of these bugs can leave a machine vulnerable to exploitation by attackers. In an effort to lessen the exposure, the NetBSD packages team maintains a database of known-exploits to packages which have at one time been included in pkgsrc. The database can be downloaded automatically, and a security audit of all packages installed on a system can take place. To do this, refer to the following two tools (installed as part of the pkgtools/pkg_install package):

pkg_admin fetch-pkg-vulnerabilities, an easy way to download a list of the security vulnerabilities information. This list is kept up to date by the pkgsrc security team, and is distributed from the NetBSD ftp server:

ftp://ftp.NetBSD.org/pkgsrc/distfile...ulnerabilities

pkg_admin audit, an easy way to audit the current machine, checking each known vulnerability. If a vulnerable package is installed, it will be shown by output to stdout, including a description of the type of vulnerability, and a URL containing more information.

Use of these tools is strongly recommended! After “pkg_install” is installed, please read the package's message, which you can get by running pkg_info -D pkg_install.

If this package is installed, pkgsrc builds will use it to perform a security check before building any package. See Section 5.2, “Variables affecting the build process” for ways to control this check.
It is possible that pkg-tools is not installed or your paths are incorrect. Can you provide # pkg_info | grep pkg
and # echo $PKG-PATH

Last edited by shep; 2nd June 2013 at 03:01 PM. Reason: correct cmd tag
Reply With Quote
  #5   (View Single Post)  
Old 6th October 2013
pawaan pawaan is offline
Fdisk Soldier
 
Join Date: Jan 2013
Posts: 82
Default

sorry shep for being too much late .

# pkg_info | grep pkg
Code:
tex-etex-pkg-2.0    E-TeX support package
pkg_install-20130131nb1 Package management and administration tools for pkgsrc
pkgin-0.6.4         Apt / yum like tool for managing pkgsrc binary packages
pkg-config-0.28     System for managing library compile/link flags
p5-ExtUtils-PkgConfig-1.13nb2 Simplistic perl interface to pkg-config
echo $PKG_PATH
Code:
ftp://ftp3.de.netbsd.org/pub/pkgsrc/packages/NetBSD/i386/6.0_2013Q2/All
after upgrading to 6.1.2 , problems persist.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Wireshark updates fix DoS vulnerabilities J65nko News 0 25th July 2012 04:53 PM
Security Wireshark updates fix DoS vulnerabilities J65nko News 0 1st April 2012 02:55 AM
phpMyAdmin 3.4.9 fixes XSS vulnerabilities J65nko News 0 23rd December 2011 07:29 AM
tracking vulnerabilities albator NetBSD Security 4 22nd September 2011 07:33 PM
Sun Java System Web Server - Active Server Pages (yes ASP) hopla FreeBSD General 0 26th September 2008 08:22 AM


All times are GMT. The time now is 05:45 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick