From owner-freebsd-questions@FreeBSD.ORG Tue Jul 26 00:52:27 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B823816A41F for ; Tue, 26 Jul 2005 00:52:27 +0000 (GMT) (envelope-from freebsd-questions@auscert.org.au) Received: from titania.auscert.org.au (gw.auscert.org.au [203.5.112.28]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2AB5843D45 for ; Tue, 26 Jul 2005 00:52:26 +0000 (GMT) (envelope-from freebsd-questions@auscert.org.au) Received: from app.auscert.org.au (app [10.0.1.192]) by titania.auscert.org.au (8.12.10/8.12.10) with ESMTP id j6Q0oamG039203 for ; Tue, 26 Jul 2005 10:50:36 +1000 (EST) Received: from app.auscert.org.au (localhost.auscert.org.au [127.0.0.1]) by app.auscert.org.au (8.13.1/8.13.1) with ESMTP id j6Q0qPYj020484 for ; Tue, 26 Jul 2005 10:52:25 +1000 (EST) (envelope-from freebsd-questions@auscert.org.au) Message-Id: <200507260052.j6Q0qPYj020484@app.auscert.org.au> To: freebsd-questions@freebsd.org from: freebsd-questions@auscert.org.au In-Reply-To: Your message of "25 Jul 2005 13:26:10 -0400." <44fyu2n6fh.fsf@be-well.ilk.org> Date: Tue, 26 Jul 2005 10:52:25 +1000 Subject: Re: How to create mtree files? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jul 2005 00:52:27 -0000 > freebsd-questions@auscert.org.au writes: > > > I would like to use the mtree utility to confirm no changes have > > occurred to system files since 'make installworld', similar to that > > possible with 'mtree -f /cdrom/5.4-RELEASE/base/base.mtree' on a > > release installation. This would also give the added advantage of > > being able to determine the current buildlevel of an installed > > system, I believe. Is it possible/easy to create new mtree files > > after the buildworld or installworld process? I've looked at the > > Release Engineering docs but it seems more than what I'd like to > > do. I should add that I am running tripwire, but I really want to > > have a quick way to verify which files were part of which installworld. > > "man 8 mtree" has full details. > > "mtree -c -p /" is the start of what you're looking for. Thanks - I misinterpreted what the '-c' flag does, but after running your example it all makes sense now. To wrap this up for me, is mtree the way to maintain a record of at what level a particular build was performed? In other words, using 'uname -a' tells me when the kernel was built, but what best tells me when /usr/bin/telnet was patched and built and against what source? cheers, -- Joel Hatton -- Security Analyst | Hotline: +61 7 3365 4417 AusCERT - Australia's national CERT | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert@auscert.org.au