I would like to install Metasploit on an hardened OS.
For this purpose I chose Mavericks just because I'm able to harden this OS pretty far.

I would like to install Metasploit with MacPorts because until now, all the best security tools I needed were correctly manageable with MacPorts through 4 different versions of MacOS X (Snow Leopard, Lion, Mountain Lion, Mavericks).
(This installation challenge is part of a baptism by fire.)

I already did this installation on previous versions of this OS.
I also already found pretty good references to install Metasploit on MacOS X:

Unfortunately none of these answer to my search, and none lead me to a successfull installation.

Do you know a correct and tested receipe to install Metasploit on Mavericks + MacPorts?

  • You may want to visit the Apple Stack Exchange. – Rory Alsop Sep 3 '14 at 14:09
  • This question is much too focused about a "security tool" to interest anyone on apple.stackexchange which I much more than visit :). – dan Sep 3 '14 at 17:36

Version used

MacOS X        10.9.4
Xcode          5.1.1
MacPorts       2.3.1
Ruby           1.9.3
Postgresql     9.3.5
Metasploit     4.9.3


To avoid any confusion between system, MacPorts and Metasploit binaries it is fundamental to start to install everything in clearly separate part of the filesystem.

Here are the choices I took:

/local/MacPorts     initial install of MacPorts
/local/Metasploit   install of Metasploit
/opt/local          install of everything managed with MacPorts


The overall steps to install completly Metasploit are:

  1. Xcode + command line tools
  2. MacPorts
  3. Ruby
  4. Postgresql
  5. Metasploit

1. Xcode + command line tools

  • Download Xcode 5.1.1 from the App Store (2 Go)
  • launch it to check and accept the licence
  • install the command line tools with:

    xcode-select --install

2. MacPorts

  • Create the initial directory structure (let's say my account is BOB).

    $ /usr/bin/sudo mkdir -p /local/MacPorts
    $ /usr/bin/sudo chown BOB /local/MacPorts
  • Download the latest tarball:

    From MacPorts: MacPorts 2.3.1 to save it under:

  • Extract

    $ cd /local/MacPorts
    $ tar xvf MacPorts-2.3.1.tar.bz2
  • Configure, install

    $ /usr/bin/sudo mkdir -p /opt/local
    $ cd MacPorts-2.3.1
    $ ./configure --prefix=/opt/local
    $ /usr/bin/sudo make install

    port isn't in my PATH, and this is normal.

  • 1st PATH switch

    (I'm using zsh) insert within ${HOME}/.profile, within the section which is always run and after any other PATH or MANPATH definition:

    export PATH
    export MANPATH

    PATH switch:

    $ . ${HOME}/.profile
  • Update MacPorts DB

    $ /usr/bin/sudo port -d selfupdate

    port in in my PATH, and this is normal.

3. Ruby

  • Download, configure and install ruby19

    $ /usr/bin/sudo port install ruby19
    $ /usr/bin/sudo port select ruby ruby19

    check that everything is ok thus far: $ type ruby /opt/local/bin/ruby $ ruby --version ruby 1.9.3p547 ...

  • Download, configure and install bundler

    $ gem install bundler

4. Postgresql

  • Download, configure and install postgresql93

    $ /usr/bin/sudo port install postgresql93-server

    the correct install will display:

To create a database instance, after install do
 sudo mkdir -p /opt/local/var/db/postgresql93/defaultdb
 sudo chown postgres:postgres /opt/local/var/db/postgresql93/defaultdb
 sudo su postgres -c '/opt/local/lib/postgresql93/bin/initdb -D /opt/local/var/db/postgresql93/defaultdb' 

Simply run these 3 commands, and on correct DB initialization, postgresql will warn you:

WARNING: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.

Success. You can now start the database server using:

    /opt/local/lib/postgresql93/bin/postgres -D /opt/local/var/db/postgresql93/defaultdb
    /opt/local/lib/postgresql93/bin/pg_ctl -D /opt/local/var/db/postgresql93/defaultdb -l logfile start
  • Use the launchd plist installed by MacPorts in the right place:

    $ /usr/bin/sudo launchctl load -w /Library/LaunchDaemons/org.macports.postgresql93-server.plist

    check that everything is ok thus far:

    $ telnet localhost 5432
    Trying ::1...
    Connected to localhost.


  • Secure postgresql (a vulnerabilities DB should be of very restricted access)

    $ cd /opt/local/var/db/postgresql93/defaultdb

    edit pg_hba.conf to remove the lines:

    local   all     all                     trust
    host    all     all    trust
    host    all     all     ::1/128         trust

    and replace them with:

    local   postgres        postgres                trust
    local   msf_db          msf_user                trust

    Restart postgresql in this mode limited in access through UNIX domain socket.

    $ /usr/bin/sudo launchctl stop org.macports.postgresql93-server
  • Select the correct postgresql version

    $ /usr/bin/sudo port select postgresql postgresql93
  • Configure the Metasploit DB to use

    Let's say the user to use will be msf_user, with password pass_pass and the DB will be msf_db. Switch to user postgres:

    $ /usr/bin/sudo /usr/bin/su postgres
    $ createuser msf_user -p
    Enter password for new role: pass_pass
    Enter it again: pass_pass
    $ createdb -O msf_user msf_db

    These 2 commands won't display anything, this means everything is OK.

5. Metasploit

  • Install Metasploit

    $ /usr/bin/sudo mkdir -p /local/Metasploit
    $ /usr/bin/sudo chown BOB /local/Metasploit
    $ cd /local/Metasploit
    $ git clone --depth=1 git://github.com/rapid7/metasploit-framework .
  • 2nd PATH switch

    Insert within ${HOME}/.profile, within the section which is always run and after any other PATH or MANPATH definition:

    export PATH

    PATH switch:

    $ . ${HOME}/.profile
  • Update Metasploit:

     $ msfupdate
  • Configure the DB access:

    $ cd /local/Metasploit/config
    $ cp database.yml.example database.yml
    $ vi database.yml

    to include there this uniq block:

      adapter:      postgresql
      database:     msf_db
      username:     msf_user
      password:     pass_pass
      port:         5432
      pool:         75
      timeout:      5

    To get an automatic connection at each start, include the following line within the metasploit initialization script:

    $ cat >${HOME}/.msf4/msfconsole.rc <<eof
    db_connect -y /local/Metasploit/config/database.yml
  • Check that everything is working:

    $ msfconsole
    msf > db_status
    [*] postgresql connected to msf_db
    msf >
  • Help yourself a cup of champaign :).

| improve this answer | |
  • 1
    Thanks a lot for a comprehensive guide. To install postgreSQL DB, the command should be $ /usr/bin/sudo port install postgresql93-server. – void_in Aug 24 '14 at 14:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.