Re: Alternatives to CVSUP for Security Updates and Errata

2004-08-26 Thread Dan Nelson
In the last episode (Aug 26), Kenneth A. Bond said:
> I currently manage several FreeBSD 4.9 and 4.10 servers that serve as
> high volume web servers to several of our employees worldwide.
>  
> As you can imagine, in firm the size of ours, various teams are
> reponsible for various aspects of our technology infrastructure. With
> that said, I have requested to have our security team create a policy
> that will allow traffic to and from my servers via port 5999 for
> CVSup, so that I could synch my source.
>  
> My request has been flatly refused, due to the fact that FreeBSD is
> not a firm-standard operating system. The security team will not open
> up the firewalls for this purpose. CVSup is not an option.

You don't need to allow incoming connections to port 5999; cvsup by
default will multiplex traffic over the one outgoing connection.  You
can also connect through a SOCKS proxy server (but not an HTTP proxy)
if your company has one.  If your firewall blocks all outgoing TCP
connects, then you are probably stuck.

-- 
Dan Nelson
[EMAIL PROTECTED]
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"


Re: Alternatives to CVSUP for Security Updates and Errata

2004-08-26 Thread Phil Schulz
Kenneth A. Bond wrote:
[Has no way of upgrading sources via CVSup b/c of firewalls]
If your security guys do not block SSH traffic, you could check out your 
sources using CVS over ssh.
See 
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/anoncvs.html 
for some mirrors which allow ssh.

Regards,
Phil.
P.S.: Oh, and wrap your lines...
--
Did you know...
If you play a Windows 2000 CD backwards, you hear satanic messages,
but what's worse is when you play it forward
   ...it installs windows 2000
-- Alfred Perlstein on [EMAIL PROTECTED]
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"