4

Security is a major concern. Every major Linux distribution uses signed packages. But the FreeBSD systems in the office downloading unsigned packages/ports via FTP.

Is there a solution that would allow me to securely update a *BSD on a malicious network?

Zypher
  • 37,405
  • 5
  • 53
  • 95
Rook
  • 2,655
  • 6
  • 27
  • 35

1 Answers1

6

Use freebsd-update for official binary system updates.
When you upgrade packages from ports (e.g. with "portsnap" and "portmaster" like I do) the packages' source-files ARE signed with SHA256 checksums and verified before compilation, so I wouldn't worry about that.
Since it seems you're very much security-aware, I'd go with compiling ports from signed sources if I were you anyway.

Henk
  • 1,331
  • 11
  • 24
  • +1 Yep, almost every update mechanism uses SHA256 and/or MD5 checksums to ensure packages and source files are correctly fetched. – Chris S May 25 '11 at 20:42