Skip to content

16. Security & Updates

NTPSense includes a built-in vulnerability and patch management dashboard — it checks your installed packages and base system against known CVEs (via pkg audit and the National Vulnerability Database), lets you apply updates with one click, and keeps a permanent, tamper-evident record of every update ever applied.

This guide walks through reading the dashboard, applying updates, rolling one back if needed, and a few things that aren't obvious from the UI alone.

1. Prerequisites

  • NTPSense CE or Pro, logged in as an Administrator
  • Outbound internet access from the gateway (this feature fetches CVE data from the National Vulnerability Database and downloads packages from the FreeBSD repository)

2. Where to Find It

Open System > Security & Updates.

The page has three summary cards at the top — Components tracked, Critical / high findings, and Last checked — followed by two detail cards: Base system and kernel and Package updates.

3. Base System and Kernel

This card shows your currently installed FreeBSD userland and kernel versions.

Note: Automated "is a newer base system version available" checking is not yet built — this card shows what's installed, not whether it's current. Check the FreeBSD Security Advisories page directly, or run freebsd-update fetch from the console, to check for base system updates. Applying a base system update requires a reboot — plan it for a maintenance window.

4. Package Updates

Click Check now on the Package updates card to scan installed packages against known vulnerabilities and available updates.

  • This can take anywhere from a few seconds to under a minute, depending on whether the CVE database needs a fresh download. You do not need to click it more than once — clicking repeatedly does not speed it up.
  • Each row shows: the component, installed version, install date, Severity (Critical / High / Medium / Low / Unknown / None), a description, release date, download size, and an action.

Severity of "Unknown" means a CVE exists for that package but the National Vulnerability Database has not yet assigned it a CVSS score — this is common for very recently disclosed vulnerabilities. It does not mean "not serious," just "not yet scored."

Action column shows one of three things: - Update now — a fix is available; click to apply it. - No fix available yet — the package has a known Critical/High/Medium severity finding, but no newer version exists in the repository yet to fix it. Keep an eye on this one. - Installed only — informational finding (e.g. a maintenance note), no action needed.

⚠️ If "Check now" reports an error: A message like "Vulnerability database check did not complete" means the CVE database download itself failed (usually a transient network issue on the path to the upstream server, not a problem with NTPSense) — package version checking still works normally, only CVE/severity data may be temporarily incomplete. Try Check now again in a few minutes.

5. Applying an Update

  1. Click Update now on the row for the package you want to update.
  2. Confirm the prompt.
  3. A confirmation message appears once the update is applied. Click Check now again to refresh the list and confirm the package no longer appears as needing an update.

6. Patch History

Below the Package Updates table, the Patch History card keeps a permanent record of every update ever applied from this page — package, version before/after, severity at the time, and exactly when it was installed. This record is never cleared automatically; it exists for audit purposes.

Each entry that can still be rolled back shows a Rollback button.

Note: Rollback only works if FreeBSD's package cache (/var/cache/pkg) still holds the previous version's file — this is typically true shortly after an update, but the cache can be cleaned over time. If Rollback is unavailable for an old entry, the previous version's package file is no longer available locally.

After a rollback, click Check now again — the package will correctly reappear in the Package Updates list, since it is once more running an outdated version.

7. Verifying Everything Works

  1. Click Check now and confirm Last checked updates to the current time.
  2. If any packages show Update now, apply one and confirm it disappears from the list on the next check.
  3. Confirm it now appears in Patch History with the correct before/after version.

If Components tracked stays at 0 with no error shown, your system genuinely has no outstanding findings — this is the expected, healthy state, not a sign that the check didn't run.