WARNING: Vulnerability database out of date, checking anyway

[mfaridi]

I use FreeBSD 7 , and want install some packages by Port
If I want install some package I see this error

 WARNING: Vulnerability database out of date, checking anyway

How I fix this

I see this error in install ntop , enlightenment , gtk12 , ...

[mtx]

have you installed /usr/ports/security/portaudit and ran

portaudit -Fda

-F to fetch the database from freebsd servers
-a to print the vulnerabilities or all installed packages
-d print the creation of the database
^ from the man page

all the best,
v

[mfaridi]

Originally Posted by mtx

have you installed /usr/ports/security/portaudit and ran

portaudit -Fda

-F to fetch the database from freebsd servers
-a to print the vulnerabilities or all installed packages
-d print the creation of the database
^ from the man page

all the best,
v

Yes I install this package and run it and find some package with security risk

[mtx]

Originally Posted by mfaridi

 WARNING: Vulnerability database out of date, checking anyway

looks like you already had portaudit installed but the database was out of date.
refreshing the database should be done automatically from daily periodic scripts.

Yes I install this package and run it and find some package with security risk

update those packages if you like to

all the best,
v

[Carpetsmoker]

Well, you should see if the issues affect you, and uprade as neccesary.

The "Vulnerability database out of date" should be gone now, portaudit is now run on every port installation to make sure you're not installing ports with know security issues.

portaudit also added /usr/local/etc/periodic/security/410.portaudit
This script automatically updates the portaudit database and checks all ports for known vulnerabilities when periodic daily is run (usually from cron, it's in /etc/crontab by default).

To enable it add:

daily_status_security_portaudit_enable="YES"

to /etc/periodic.conf

See periodic(8) and periodic.conf(5), and portaudit(1) for more information.

[mtx]

Originally Posted by Carpetsmoker

To enable it add:

daily_status_security_portaudit_enable="YES"

to /etc/periodic.conf

@ Carpetsmoker
strange thing now that you mention it. i don't have an /etc/periodic.conf
file and never added

daily_status_security_portaudit_enable="YES"

to it _but_ the daily portaudit check still runs. how is that possible? thank you

all the best,
v

[Carpetsmoker]

strange thing now that you mention it. i don't have an /etc/periodic.conf

periodic.conf works like rc.conf, the defaults are in /etc/defaults/periodic.conf and /etc/periodic.conf overrides these settings.

I see that portaudit is enabled by default, usually periodic scripts are disabled by default ...

I'm not sure why 410.portaudit didn't run for mfaridi then, maybe he disabled the periodic entries in crontab? Or disabled 410.portaudit in /etc/periodic.conf?

[mfaridi]

Originally Posted by Carpetsmoker

Well, you should see if the issues affect you, and uprade as neccesary.

The "Vulnerability database out of date" should be gone now, portaudit is now run on every port installation to make sure you're not installing ports with know security issues.

portaudit also added /usr/local/etc/periodic/security/410.portaudit
This script automatically updates the portaudit database and checks all ports for known vulnerabilities when periodic daily is run (usually from cron, it's in /etc/crontab by default).

To enable it add:

daily_status_security_portaudit_enable="YES"

to /etc/periodic.conf

See periodic(8) and periodic.conf(5), and portaudit(1) for more information.

But I can not find periodic.conf

/etc/

[Carpetsmoker]

As I said before:
periodic.conf works like rc.conf, the defaults are in /etc/defaults/periodic.conf and /etc/periodic.conf overrides these settings.

So this means the /etc/periodic.conf does not exist by default, and that you will have to create the file.

[mfaridi]

Originally Posted by Carpetsmoker

As I said before:
periodic.conf works like rc.conf, the defaults are in /etc/defaults/periodic.conf and /etc/periodic.conf overrides these settings.

So this means the /etc/periodic.conf does not exist by default, and that you will have to create the file.

Ok thanks , I will do that