diff --git a/cmake/InstallClobberImmune.cmake b/cmake/InstallClobberImmune.cmake
new file mode 100644
index 0000000000..77da312ef2
--- /dev/null
+++ b/cmake/InstallClobberImmune.cmake
@@ -0,0 +1,20 @@
+# Determines at `make install` time if a file, typically a configuration
+# file placed in $PREFIX/etc, shouldn't be installed to prevent overwrite
+# of an existing file.
+#
+# _srcfile: the file to install
+# _dstfile: the absolute file name after installation
+
+macro(InstallClobberImmune _srcfile _dstfile)
+    install(CODE "
+        if (EXISTS ${_dstfile})
+            message(STATUS \"Skipping: ${_dstfile} (already exists)\")
+        else ()
+            message(STATUS \"Installing: ${_dstfile}\")
+            # install() is not scriptable within install(), and
+            # configure_file() is the next best thing
+            configure_file(${_srcfile} ${_dstfile} COPY_ONLY)
+            # TODO: create additional install_manifest files?
+        endif ()
+    ")
+endmacro(InstallClobberImmune)
diff --git a/cmake/InstallPackageConfigFile.cmake b/cmake/InstallPackageConfigFile.cmake
new file mode 100644
index 0000000000..65a1724ea4
--- /dev/null
+++ b/cmake/InstallPackageConfigFile.cmake
@@ -0,0 +1,39 @@
+include(InstallClobberImmune)
+
+# This macro can be used to install configuration files which
+# users are expected to modify after installation.  It will:
+#
+#   - Always install one version of the file with a .example suffix
+#   - If binary packaging is enabled:
+#     Install the file in the typical CMake fashion, but append to the
+#     INSTALLED_CONFIG_FILES cache variable for use with the Mac package's
+#     pre/post install scripts
+#   - If binary packaging is not enabled:
+#     Install the script in a way such that it will check at `make install`
+#     time whether the file does not exist.  See InstallClobberImmune.cmake
+#
+#   _srcfile: the absolute path to the file to install
+#   _dstdir: absolute path to the directory in which to install the file
+#   _dstfilename: how to (re)name the file inside _dstdir
+
+macro(InstallPackageConfigFile _srcfile _dstdir _dstfilename)
+    set(_dstfile ${_dstdir}/${_dstfilename})
+
+    # Always install the latest version of the file renamed as an example
+    install(FILES ${_srcfile} DESTINATION ${_dstdir}
+            RENAME ${_dstfilename}.example)
+
+    if (BINARY_PACKAGING_MODE)
+        # If packaging mode is enabled, always install the distribution's
+        # version of the file.  The Mac package's pre/post install scripts
+        # or native functionality of RPMs will take care of not clobbering it.
+        install(FILES ${_srcfile} DESTINATION ${_dstdir} RENAME ${_dstfilename})
+        # This cache variable is what the Mac package pre/post install scripts
+        # use to avoid clobbering user-modified config files
+        set(INSTALLED_CONFIG_FILES
+            "${INSTALLED_CONFIG_FILES} ${_dstfile}" CACHE STRING "" FORCE)
+    else ()
+        # Have `make install` check at run time whether the file does not exist
+        InstallClobberImmune(${_srcfile} ${_dstfile})
+    endif ()
+endmacro(InstallPackageConfigFile)
diff --git a/cmake/package_postupgrade.sh.in b/cmake/package_postupgrade.sh.in
index 7ae35185f6..0ef78413c3 100755
--- a/cmake/package_postupgrade.sh.in
+++ b/cmake/package_postupgrade.sh.in
@@ -5,7 +5,7 @@
 
 backupNamesFile=/tmp/bro_install_backups
 version=@VERSION@
-newFiles=""
+sampleFiles=""
 
 # check whether it's safe to remove backup configuration files that
 # the most recent package install created
@@ -28,10 +28,8 @@ if [ -e ${backupNamesFile} ]; then
             # by the user, we should restore it to its original location
             # and rename the new version appropriately.
 
-            newFileName=${origFileName}.${version}
-            newFiles="${newFiles}\n${newFileName}"
+            sampleFiles="${sampleFiles}\n${origFileName}.example"
 
-            mv ${origFileName} ${newFileName}
             mv ${backupFile} ${origFileName}
         fi
 
@@ -40,12 +38,12 @@ if [ -e ${backupNamesFile} ]; then
     rm ${backupNamesFile}
 fi
 
-if [ -n "${newFiles}" ]; then
+if [ -n "${sampleFiles}" ]; then
 # Use some apple script to display a message to user
 /usr/bin/osascript << EOF
     tell application "System Events"
         activate
-        display alert "Existing configuration files differ from the ones that would be installed by this package.  To avoid overwriting configuration which you may have modified, the following new config files have been installed:\n${newFiles}\n\nIf you have previously modified configuration files, please make sure that they are still compatible, else you should update your config files to the new versions."
+        display alert "Existing configuration files differ from the ones that would be installed by this package.  To avoid overwriting configuration which you may have modified, the following new config files have been installed:\n${sampleFiles}\n\nIf you have previously modified configuration files, please make sure that they are still compatible, else you should update your config files to the new versions."
     end tell
 EOF
 fi
diff --git a/cmake/package_preinstall.sh.in b/cmake/package_preinstall.sh.in
index 790e750f0e..749b01fdfc 100755
--- a/cmake/package_preinstall.sh.in
+++ b/cmake/package_preinstall.sh.in
@@ -20,7 +20,7 @@ backupFile () {
 
         backupFile=${origFile}.${ver}
 
-        cp ${origFile} ${backupFile}
+        cp -p ${origFile} ${backupFile}
 
         # the post upgrade script will check whether the installed
         # config file actually differs from existing version
diff --git a/configure b/configure
index f1d864640d..864e3e4803 100755
--- a/configure
+++ b/configure
@@ -54,6 +54,7 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
     --with-swig=PATH       path to SWIG executable
 
   Packaging Options (for developers):
+    --binary-package       toggle special logic for binary packaging
     --ignore-dirs=PATHS    paths to ignore when creating source package
                            (semicolon delimited and quoted when multiple)
     --pkg-name-prefix=NAME use the given name as the package prefix instead
@@ -195,6 +196,9 @@ while [ $# -ne 0 ]; do
         --with-swig=*)
             append_cache_entry SWIG_EXECUTABLE      PATH    $optarg
             ;;
+        --binary-package)
+            append_cache_entry BINARY_PACKAGING_MODE BOOL true
+            ;;
         --ignore-dirs=*)
             append_cache_entry CPACK_SOURCE_IGNORE_FILES STRING $optarg
             ;;
diff --git a/make-mac-packages b/make-mac-packages
index 713d8d3311..c3b6736d20 100755
--- a/make-mac-packages
+++ b/make-mac-packages
@@ -3,6 +3,8 @@
 # This script creates binary packages for Mac OS X.
 # They can be found in build/ after running.
 
+prefix=/opt/bro
+
 # CMake/CPack versions before 2.8.2 have bugs that can create bad packages
 CMAKE_PACK_REQ=2.8.3
 CMAKE_VER=`cmake -version`
@@ -37,31 +39,26 @@ else
 fi
 
 # Minimum Bro
-CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=/opt/bro \
-    --disable-broccoli --disable-broctl --pkg-name-prefix=Bro
-cd build
-make package
-cd ..
+CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=${prefix} \
+    --disable-broccoli --disable-broctl --pkg-name-prefix=Bro \
+    --binary-package
+( cd build && make package )
 
 # Full Bro package
-CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=/opt/bro \
-    --pkg-name-prefix=Bro-all
-cd build
-make package
-cd ..
+CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=${prefix} \
+    --pkg-name-prefix=Bro-all --binary-package
+( cd build && make package )
 
 # Broccoli
 cd aux/broccoli
-CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=/opt/bro
-cd build
-make package
-mv Broccoli*.dmg ../../../build/
-cd ../../..
+CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=${prefix} \
+    --binary-package
+( cd build && make package && mv Broccoli*.dmg ../../../build/ )
+cd ../..
 
 # Broctl
 cd aux/broctl
-CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=/opt/bro
-cd build
-make package
-mv Broctl*.dmg ../../../build/
-cd ../../..
+CMAKE_OSX_ARCHITECTURES=${arch} ./configure --prefix=${prefix} \
+    --binary-package
+( cd build && make package && mv Broctl*.dmg ../../../build/ )
+cd ../..
diff --git a/make-rpm-packages b/make-rpm-packages
index bbd797b8e2..503d80ef4e 100755
--- a/make-rpm-packages
+++ b/make-rpm-packages
@@ -3,6 +3,8 @@
 # This script generates binary RPM packages.
 # They can be found in build/ after running.
 
+prefix=/opt/bro
+
 # CMake/CPack versions before 2.8.2 have bugs that can create bad packages
 CMAKE_PACK_REQ=2.8.2
 CMAKE_VER=`cmake -version`
@@ -13,30 +15,22 @@ if [ "${CMAKE_VER}" \< "${CMAKE_PACK_REQ}" ]; then
 fi
 
 # Minimum Bro
-./configure --prefix=/opt/bro --disable-broccoli --disable-broctl \
-            --pkg-name-prefix=Bro
-cd build
-make package
-cd ..
+./configure --prefix=${prefix} --disable-broccoli --disable-broctl \
+            --pkg-name-prefix=Bro --binary-package
+( cd build && make package )
 
 # Full Bro package
-./configure --prefix=/opt/bro --pkg-name-prefix=Bro-all
-cd build
-make package
-cd ..
+./configure --prefix=${prefix} --pkg-name-prefix=Bro-all --binary-package
+( cd build && make package )
 
 # Broccoli
 cd aux/broccoli
-./configure --prefix=/opt/bro
-cd build
-make package
-mv Broccoli*.rpm ../../../build/
-cd ../../..
+./configure --prefix=${prefix} --binary-package
+( cd build && make package && mv Broccoli*.rpm ../../../build/ )
+cd ../..
 
 # Broctl
 cd aux/broctl
-./configure --prefix=/opt/bro
-cd build
-make package
-mv Broctl*.rpm ../../../build/
-cd ../../..
+./configure --prefix=${prefix} --binary-package
+( cd build && make package && mv Broctl*.rpm ../../../build/ )
+cd ../..