pkgbase equivalent of freebsd-update IDS

R

RichardM

Hello, I thought it might be useful to share the easiest way I have found to duplicate 'freebsd-update IDS' within a pkgbase system.

It should be noted that 'freebsd-update IDS' is NOT an Intrusion Detection System - it would be very easy for someone with root access to modify freebsd-update to not highlight malicious files or changes. It is simply a comparison of the whole filesystem against a known copy of a FreeBSD installation (with system updates) before any changes have been made. So it's useful for seeing what changes you have made over the years, identifying any files you left around that are no longer needed, etc. If you were doing a reinstall of FreeBSD you would then know which system files to alter.

First, make a directory to install the copy (doesn't need to be /ids):

mkdir /ids

Then create a copy of FreeBSD as would be installed:

export BSDINSTALL_CHROOT=/ids
bsdinstall pkgbase

Then create mtree information for the copy (you can change the information stored if you want):

mtree -c -R time,size,nlink -K sha512 -p /ids -X exclude.mtree >ids.mtree

exclude.mtree contains directories that we expect to be changed, so there's no point including these. For me I use:

Code: 
./boot/kernel.old/*
./tmp/*
./var/*
./usr/local/*
./dev/*
./proc/*
./media/*

Then compare your current system against the copy:

mtree -p / -f ids.mtree -X exclude.mtree >ids.out

ids.out then shows you what has changed in a readable format.

If you have kept your system up-to-date this procedure will work, as bsdinstall pkgbase will include the latest patches.
 
Thanks - yes I saw that thread. Agree with your comments about pkg-check. Although pkg-query gives a list of hashes for the files, I don't think there's a way to check owner, permissions or flags. Also, you would have to write a script to pick up files and directories that have been added after installation, after checking the files produced by pkg-query.
 
RichardM said:
Although pkg-query gives a list of hashes for the files
Click to expand...
It can also list ownership and permissions, just have to add a couple of patterns.

Code: 
     %F[psugmftl]
         Expands to the list of files of the matched package, where p stands
         for path, s for checksum, u for owner, g for group, m for mode
         (permissions), f for file flags, l for last modification time, and t
         for the symlink target (or empty string if no symlink).

You may also want to add (sub)directories;
Code: 
     %S[pugmf]
         Expands to the list of (sub-)directories of the matched package,
         where p stands for path, u for owner, g for group, m for mode
         (permissions), and f for file flags. Same as %D but allows specifying
         suboptions.

With a bit of formatting of the output, I'm sure it can produce something that can be fed to mtree(1) to check.
 
Thanks - I will see if I can get that to work. That solution would be better, as you wouldn't need to store a copy of a base installation, and I'd prefer not to be using bsdinstall really.
 
You must log in or register to reply here.
Back
Top