ADVCHK(1)

NAME
advchk - reads advisories so you don`t have to

SYNPOSIS
advchk [-cdDhquv] [-ar url] [-AR [user@]host[:port] ] [-fFl file]

DESCRIPTION
advchk is a tool for monitoring the security of installed software. Advisory Check gathers security advisories using RSS / RDF / XML feeds, compares them against a list of known software, and alerts you if you`re vulnerable. Quite a few CERTs and vendors offer security-relevant feeds. Mailing lists can be monitored using feeds provided by some web archives. Some usenet gateways like Google Groups also offer RSS subscriptions. Since adding software lists by hand would be quite a boring task, advchk leverages your systems package manager for detecting software. Software installed on remote systems can be monitored using SSH-Update. SSH-Update retrieves package lists by executing the remote package manager as an SSH ForcedCommand using Public-key authentication. Enabling SSH-Update for a vanilla host is as simple as: advchk -A user@host:22 The following package managers are supported:

pkg_info
    pkg_info Open-, Net-, FreeBSD, Darwin/MacOS X

dpkg
    dpkg -l Debian, Ubuntu, ...

rpm rpm -qa Redhat/Fedora, SuSE, Turbolinux, ...

lpp lslpp -Lc AIX

pkginfo
    pkginfo -x Solaris

portage
    equery list -i Gentoo (Equery is included in "gentoolkit")

Think of advchk as your personal trainee who reads boring advisories and presents you the ones that could be interesting =)

OPTIONS

-c  Check for advisories by fetching feeds and comparing them against package lists.

-d  Enable (perl) diagnostics / debug mode.

-D  Dump the database to STDOUT.

-h, -v
    Show help message.

-q  Enable quiet mode. This should be used for cronjobs.

-u  Update package list via SSH.

-a url
    Add RSS / RDF / XML feed. You may want to run the included addfeeds.sh to get an initial set of feeds.

-r url
    Remove RSS / RDF / XML feed.

-A [user@]host[:port]
    Add host to SSH-Update pool and enable the current user to retrieve the package list by using a ForcedCommand and Public-key Authentication on the remote host. The host can be specified as eighter HOST, USER@HOST, @USER@HOST:PORT or HOST:PORT. An SSH key will be generated if not already present. The resulting package file will be kept in ~/.advchk/$HOSTNAME.list The ForcedCommand is: dpkg -l; pkg_info; rpm -qa; equery list -i; lslpp -Lc; pgkinfo -x

-R [user@]host[:port]
    Remove host from the SSH-Update pool. This does not touch any ForcedCommand setups.

-f file
    Load this database file instead of ~/.advchk/advchk.db.

-F file
    Load this package list. The naming convention is: $HOSTNAME.list Specifying an empty $HOSTNAME.list will remove $HOSTNAME from the database.

-l file
    Log messages to file. The file will be appended if present.

EXAMPLES

advchk -A alice@foo.com
    Enable SSH-Update for foo.com using the remote account alice, and A -dd foo.com to the SSH-pool.

advchk -R alice@foo.com
    R -emove alice@foo.com from the SSH-pool. Foo.com will not be updated by SSH-Update anymore, but remains in the database.

advchk -dF foo.com.list
    Enable d -ebug mode and load the package list F -ile foo.com.list. Foo.com will be added to the database if packages are detected in foo.com.list. It will be removed from the database otherwise.

advchk -a http://foo.com/cool.rdf -r http://bar.org/boring.xml
    a -dd foo.com feed and r -emove bar.org feed.

MAILTO="you@foo.com"

0 9 * * * /usr/bin/advchk -cqul ~/.advchk/advchk.log
    This cronjob will execute advchk every morning at 9 o`clock. Advchk will q -uietly u -pdate package lists from the ssh-pool and c -heck advisories. Messages will be l -ogged to ~/.advchk/advchk.log. Detected vulnerable packages will be reported to STDOUT and sent to you@foo.com by cron. This is the recommended way of running advchk.

AUTHORS
Advchk is written and maintained by Stephan Schmieder <ssc@unixgu.ru >.
Bernd Stolle | added support for Gentoo equery.
Dag Wieers | added support for AIX lslpp and Solaris pkginfo.
The current version is available at: http://advchk.unixgu.ru/

DEPENDENCIES
Advisory Check depends on the following Perl modules: |
Getopt::Std |
LWP::UserAgent |
Storable |
SSH-Update requires OpenSSH on the client side.

BUGS
As stated in the introduction, advchk should be viewed as your personal trainee. Well, as with all trainees, mistakes can occur and will result in False Positives. Don`t be to grim when these occur, advchk saves you from lots of hours reading bugtraq and the likes =)

SEE ALSO
ssh(1), crontab(5), ssh-keygen(1) and the package managers: pkg_info(1), dpkg(1), rpm(1), equery(1), lslpp(1), pkginfo(1)