Re: [WSO Core #5325] [SECURITY] [DSA 538-1] New rsync packages fix unauthorised directory traversal and file access
Hi there! Does anybody know, if rsync 2.6.2-3 will reach sarge before it is released? If not, the Security hole will be open until the Security Team will be release a fixed package. Kind regards, Jan. -- ,,_ If wishes were wings, o )~ would fly. -BEGIN GEEK CODE BLOCK- Version: 3.12 GIT d-- s+: a-- C+++ UL P+ L+++ E- W+++ N+++ o++ K++ w--- O M-- V- PS PE Y++ PGP++ t-- 5 X R tv- b+ DI- D++ G++ e++ h-- r+++ y+++ --END GEEK CODE BLOCK-- pgpoNHfycW0i2.pgp Description: PGP signature
Re: sshd: Logging illegal users
On Sun, 15 Aug 2004 12:34:59 -0600, Will Aoki wrote: Is there a way to make the sshd included with Debian/woody to also log the usernames an attacker tried to connect with? Set LogLevel VERBOSE in /etc/ssh/sshd_config LogLevel is already set to VERBOSE. But even with LogLevel DEBUG the invalid usernames are not logged. :-( I tested that on three different machines running Debian/woody. Could this be a PAM issue? Is there perhaps a configuration variable to turn on logging of invalid usernames in PAM like LOG_UNKFAIL_ENAB in /etc/login.defs? - Thomas -- PGP: 2047Bit RSA, ID 0x668E601D - Encrypted mail welcome! -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: [WSO Core #5325] [SECURITY] [DSA 538-1] New rsync packages fix unauthorised directory traversal and file access
reopen 265662 tags 265662 + sarge thanks On Thu, Aug 19, 2004 at 10:23:56 +0200, Jan Wagner wrote: Does anybody know, if rsync 2.6.2-3 will reach sarge before it is released? The current status: http://bjorn.haxx.se/debian/testing.pl?package=rsync : trying to update rsync from 2.6.2-2 to 2.6.2-3 (candidate is 4 days old) rsync is not yet built on arm: 2.6.2-2 vs 2.6.2-3 and rsync is in the needs build queue for ARM indeed (see http://www.buildd.net/buildd/arm_needs-build.txt). ARM is currently the port that has the most problems keeping up (see http://buildd.debian.org/stats/graph2-week-big.png), so it may take some time yet before a fixed rsync is available for ARM, after which the fixed package can percolate into sarge. If not, the Security hole will be open until the Security Team will be release a fixed package. Adjusting the relevant report's status accordingly, Ray -- When you are finished spreading joy on Christmas Eve, come and kick back with me and Erwin for a while. [...] We'll provide the cocoa and cookies, and we'll even teach you how to play Quake. From the Dust Puppy's letter to Santa Claus. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: sshd: Logging illegal users
TH From: Thomas Hungenberg [EMAIL PROTECTED] TH Date: Thu, 19 Aug 2004 10:44:40 +0200 TH LogLevel is already set to VERBOSE. But even with LogLevel DEBUG the TH invalid usernames are not logged. :-( I was explained some time ago by somebody that this is a security feature rather than a bug. Some users type in their passwords instead of login names (imagine that you used to Unix ssh, that does not ask for username, and then occasionally have to login from a Windows machine with PuTTY, that does. I mistyped my password in such situation at least twice :(). You do not want their clear text passwords to be in your log file, do you? -- Good luck -Boris Genius is ten percent inspiration and fifty percent capital gains. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Official security support for sarge
According to [EMAIL PROTECTED] message posted by Steve Langasek on Mon, 2 Aug 2004 00:11:55: Aug. 8: Official security support for sarge begins Anyone have any updates on this? Is it happening, is it delayed, what can we do to help? micah -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Get indexed in search engines
Got an awesome website, but no one is even aware of your online presence? Get ALL the pages of your website submitted by each important Search Engine including: Yahoo!, MSN, Google, AOL Search, Lycos, HotBot, Excite, Overture, Webcrawler, Ask Jeeves, Inktomi, etc. Having each page of your site reindexed every 2-4 months will expose your site to extra traffic. Site1: http://www.hvat.org/9767.asp Site2: http://www.hton.org/9767.asp Discover free search engine traffic for your site! Jennifer Clark, Marketing Executive ___ Press here to be out: http://bovanno.org/leave.html ___
