Re: Security

2023-05-12 Thread Jeremy Stanley
On 2023-05-12 16:27:59 -0700 (-0700), Jeffrey Chimene wrote: [...] > So far, this official Debian list is in line with my expectations. > For every 1 person on a Debian list, there are 10 who will tell > you it's a waste of time. So far, the best "stop wasting our time" > line is that Debian is unl

Re: sysadmin in training

2023-05-12 Thread Lupe Christoph
On Friday, 2023-05-12 at 21:48:55 -0400, Michael Lazin wrote: > The thing that caught my eye is disabling execution for /tmp. I > managed thousands of Debian servers at one time and I often found hacker > scripts in ./tmp because of a Wordpress exploit. This is because /tmp is > world writable an

Re: sysadmin in training

2023-05-12 Thread Michael Lazin
SInce Ossec HIDS is GNU Public licensed I think this is not a bad idea to include this in the documentation. The referenced article does describe securing Debian with open source tools and I honestly have seen this documentation for the first time tonight and I think it is very high quality. The t

Re: Security

2023-05-12 Thread Jeffrey Chimene
On 5/12/23 16:08, Jonathan Hutchins wrote: Here's hoping that this message is not lost in the flood of potentially thousands of read notifications to your mailing list post.  Hope you learned your lesson on that. I appreciate your concern that your message might have gotten lost. There aren'

Re: sysadmin in training

2023-05-12 Thread Jeffrey Chimene
On 5/12/23 10:16, Jeremy Stanley wrote: On 2023-05-12 09:53:15 -0700 (-0700), Jeffrey Chimene wrote: [...] Agreed. Actually, ossec itself has a debian package, so no ITP for me :). It made my work significantly easier since the regex package (pcre2) isn't part of the distro; the absence has a re

Re: sysadmin in training

2023-05-12 Thread Jeremy Stanley
On 2023-05-12 09:53:15 -0700 (-0700), Jeffrey Chimene wrote: [...] > Agreed. Actually, ossec itself has a debian package, so no ITP for > me :). It made my work significantly easier since the regex > package (pcre2) isn't part of the distro; the absence has a > reason, but it's still an impediment

Re: sysadmin in training

2023-05-12 Thread Jeffrey Chimene
On 5/12/23 08:47, Jeremy Stanley wrote: On 2023-05-12 08:10:04 -0700 (-0700), Jeffrey Chimene wrote: [...] I'd like to propose adding a section that describes ossec. [...] There's an (ancient) RFP for it which apparently used to be an ITP: https://bugs.debian.org/361954 There's no ossec-hids

Re: sysadmin in training

2023-05-12 Thread Jeremy Stanley
On 2023-05-12 08:10:04 -0700 (-0700), Jeffrey Chimene wrote: [...] > I'd like to propose adding a section that describes ossec. [...] There's an (ancient) RFP for it which apparently used to be an ITP: https://bugs.debian.org/361954 There's no ossec-hids package in Debian currently though, so ac

sysadmin in training

2023-05-12 Thread Jeffrey Chimene
Hi, I'd like to propose a minor change to https://www.debian.org/doc/manuals/securing-debian-manual While I have no argument with intrusion detection, I don't see anything for active response. A metaphor would be Peter Cook and Dudley Moore's extended joke: https://www.youtube.com/watch?v