RE: Debian Security Updates

2002-08-08 Thread Howland, Curtis
Then how are the packages so stored elsewhere differentiated? Or are the packages under the debian-non-US directory distributed under the other headings when grabbing from this particular server? > Previously Aurelio Turco wrote: > > Furthermore: > > > > http://security.debian.org/debian-non-

RE: Support for Potato

2002-07-24 Thread Howland, Curtis
> On Thu, 25 Jul 2002 at 01:08:29AM +0200, martin f krafft wrote: > > least as usable and stable, and until potato->woody is guaranteed to > > progress without any problems... > > > Problems? What problems? Just A LOT of tweaks I can't upgrade, it would require restarting and that would b

RE: Didn't we have that whole spam discussion last week?

2002-07-18 Thread Howland, Curtis
I humbly beseech the Debian list maintainers to make this list "subscriber only may post." Thank you. Curt- > -Original Message- > From: Phillip Hofmeister [mailto:[EMAIL PROTECTED] > Sent: Friday, July 19, 2002 2:03 AM > To: debian-security@lists.debian.org > Subject: Re: Didn't we ha

RE: You've Been Removed!

2002-07-17 Thread Howland, Curtis
Whoever did this, thank you. Curt- > -Original Message- > From: Italyminutes [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 18, 2002 06:02 > To: debian-security@lists.debian.org > Subject: You've Been Removed! > > > This message is to confirm the removal of your > email address: debia

RE: NEWS RELEASE

2002-07-02 Thread Howland, Curtis
This kind of dialog is important, because people find out what tools are available. It's convinced me to give procmail/spamassassin a try (soon...) even though I only get about 50 spam messages a day, easily and quickly deleted in elm without hazard of super-smart virii or HTML scripts. I love h

RE: Good Day

2002-07-02 Thread Howland, Curtis
If I remember correctly, doesn't that require sendmail? As for "bounce", while Kmail has that feature it does require a real reply-to address. For the vast majority of spam, the reply-to is deliberately obfuscated. > apt-get install spamassassin > > It trapped that one for me as well as 99% of

RE: Good Day

2002-07-02 Thread Howland, Curtis
> What bothers me in all of this is that Debian lists are > managed so poorly > to let this happen. The Debian lists are deliberately not "subscriber only may post" on the theory that it's better to press DEL than to prevent someone from posting. However, "subscriber only" is a simple config op

RE: Good Day

2002-07-01 Thread Howland, Curtis
Unlike most "spam", this one has actually resulted in some arrests. Well, not "this one" specifically, it's been going on for a while with multiple different people/groups attempting the "Spanish Prisoner" con game. Thanks for the email address for the Fed.Gov investigation. Curt- > > If anyone

RE: Problem with ssh

2002-06-27 Thread Howland, Curtis
Try connecting in verbose mode for debugging, I think it's "ssh -v" or even "-v -v" as I saw someone suggest recently. Something changed. The goal is to find out what. Also try "ssh -1 ..." to force version 1 access and see if that works. Curt- > > First question: > > > > Has it worked before

RE: Problem with ssh

2002-06-27 Thread Howland, Curtis
First question: Has it worked before now? Second question: What did you change between then and now? Curt- > Dear All, > > I have a problem with my ssh, when i try to connect to our > server using > ssh have an error like this : > > ssh -l [EMAIL PROTECTED] > 2f65 7463 2f73 7368 > Disconnec

RE: Ssh not upgraded when doing apt-get upgrade?

2002-06-27 Thread Howland, Curtis
Not "security updates" as such, but since the software has been changed, doesn't testing have its package replaced with the new version? I can't imagine that a known hole would be deliberately left in a package when an update has already been compiled. This is "testing", not Hamm". > Testing does

RE: Ssh not upgraded when doing apt-get upgrade?

2002-06-27 Thread Howland, Curtis
I noticed the same thing when doing the 3.3 thing two days ago that I commented on on this list. The security server is in my apt.sources list, but when I executed "apt-get upgrade", it said "0 new, 0 to be removed, 1 package(s) not updated". Dselect showed the ssh package as ready to be update

RE: PermitRootLogin enabled by default

2002-06-26 Thread Howland, Curtis
Alvin, If the cracker can get in as a user, it's merely a matter of time before they can worm their way into becoming root. Defenses against this are difficult, the NSA version "SELinux" deliberately places great restrictions on user abilities to try to prevent just such things. But I don't thi

RE: DSA 131: Apache Vulnerability

2002-06-20 Thread Howland, Curtis
I like both. The server gets "stable", but a firewall or at least firewall rules on the "public" interface. Preferrably duel interface, one "inside" on private IP, one "public", and no packet forwarding. And I couldn't agree more about the remarkable efforts of the Debian team members. Curt-

RE: Quality of security assurance with Debian vs. RedHat vs. SuSE

2002-06-12 Thread Howland, Curtis
> > Debian was the first Linux I installed, from floppies, in 1986. > > Do you mean 1996? Ah, yep. Brain fart. Thanks for noticing. > I personnaly use Linux since 1994, version 0.99pl14, was SLS > distribution. Neat. In 1995, a network engineer and systems admin associate of mine said, "I hav

RE: Quality of security assurance with Debian vs. RedHat vs. SuSE

2002-06-11 Thread Howland, Curtis
> On Tue 11 Jun 2002 19:54, Noah L. Meyerhans wrote: > > There is a lot of collaboration between the respective security > > teams for the major Linux distributions. As a result of this, > > they all tend to release necessary security updates at the same > > time. Known security updates are rarel

RE: restricting outbound access?

2002-05-15 Thread Howland, Curtis
How about group access privileges on the offending executables? Seems to me to be the natural method of restricting access to stuff. Curt- > I have a question. Is there any way to restrict outbound > access for all but > a few users? I know with iptables you can block outbound > traffic com

RE: restricting outbound access?

2002-05-15 Thread Howland, Curtis
How about group access privileges on the offending executables? Seems to me to be the natural method of restricting access to stuff. Curt- > I have a question. Is there any way to restrict outbound > access for all but > a few users? I know with iptables you can block outbound > traffic com

RE: beach towel

2002-05-15 Thread Howland, Curtis
Hoopy Froods always know where their towel is. > Could be handy I spose if a server caught on fire, could > throw a couple > of towels on top to smoother the fire :) > > Nathan > > On Wednesday, May 15, 2002, at 06:01 PM, Peter Obermeier wrote: > > > Hi all, > > > > it is a very courios form

RE: beach towel

2002-05-15 Thread Howland, Curtis
Hoopy Froods always know where their towel is. > Could be handy I spose if a server caught on fire, could > throw a couple > of towels on top to smoother the fire :) > > Nathan > > On Wednesday, May 15, 2002, at 06:01 PM, Peter Obermeier wrote: > > > Hi all, > > > > it is a very courios form

RE: Why is there a prompt for a root shell when the default linuxkernel boots?

2002-04-30 Thread Howland, Curtis
Where might one find documentation on this bf2.4 kernel? > Javier Fernández-Sanguino Peña wrote: > > Now that I think of it this might be an issue with > self-installed > > kernels. I'm going to document this behavior in the Manual, > commit the > > changes and close the bug. Of course, woo

RE: Why is there a prompt for a root shell when the default linuxkernel boots?

2002-04-30 Thread Howland, Curtis
Where might one find documentation on this bf2.4 kernel? > Javier Fernández-Sanguino Peña wrote: > > Now that I think of it this might be an issue with > self-installed > > kernels. I'm going to document this behavior in the Manual, > commit the > > changes and close the bug. Of course, wo

RE: connection refuse by tcp_wrapper

2002-04-24 Thread Howland, Curtis
I know this may sound like a silly question, but did it work before you applied the TCP wrappers? If you remove the all:all from hosts.deny, does it work? It's been a while since I last set up wrappers, but in all other systems I make sure it works first, then apply changes one by one and test

RE: connection refuse by tcp_wrapper

2002-04-24 Thread Howland, Curtis
I know this may sound like a silly question, but did it work before you applied the TCP wrappers? If you remove the all:all from hosts.deny, does it work? It's been a while since I last set up wrappers, but in all other systems I make sure it works first, then apply changes one by one and test

RE: Lost root password!!

2002-04-23 Thread Howland, Curtis
Stef, I've noticed during the boot sequence of 2.4.18, after the ramdisk is loaded there is a 5 second pause during which time you can get a root shell. Do you get this opportunity? I realize it asks for a password, but it is one more thing to try. Other than that, using a rescue disk or the i

RE: Lost root password!!

2002-04-23 Thread Howland, Curtis
Stef, I've noticed during the boot sequence of 2.4.18, after the ramdisk is loaded there is a 5 second pause during which time you can get a root shell. Do you get this opportunity? I realize it asks for a password, but it is one more thing to try. Other than that, using a rescue disk or the i

RE: Guarding against evil software installation scripts?

2002-04-18 Thread Howland, Curtis
> From: Tim Freeman [mailto:[EMAIL PROTECTED] ... > But whose reputation? The package maintainer directly, the Debian project indirectly. I'm not really talking about individuals, I'm talking about generalities. On a really secure machine, you're not going to be installing games, or utilities

RE: Guarding against evil software installation scripts?

2002-04-18 Thread Howland, Curtis
> From: Tim Freeman [mailto:[EMAIL PROTECTED]] ... > But whose reputation? The package maintainer directly, the Debian project indirectly. I'm not really talking about individuals, I'm talking about generalities. On a really secure machine, you're not going to be installing games, or utilities

RE: Guarding against evil software installation scripts?

2002-04-18 Thread Howland, Curtis
> I don't see a clear path to doing this the "right" way, where chaos is > prevented by something more substantial than a social convention. > > I have to admit that the social convention is working very well at the > moment, though. > > -- > Tim Freeman > [EMAIL PROTECTED] At some poi

RE: Guarding against evil software installation scripts?

2002-04-17 Thread Howland, Curtis
> I don't see a clear path to doing this the "right" way, where chaos is > prevented by something more substantial than a social convention. > > I have to admit that the social convention is working very well at the > moment, though. > > -- > Tim Freeman > [EMAIL PROTECTED] At some poi

Offtopic RE: About user monitoring

2002-04-17 Thread Howland, Curtis
> Nathan Norman - Micromuse Ltd. mailto:[EMAIL PROTECTED] > Gil-galad was an Elven-king.| The Fellowship > Of him the harpers sadly sing: |of > the last whose realm was fair and free | the Ring > between the Mountains and the Sea. | J.R.R. Tolkien A king o

Offtopic RE: About user monitoring

2002-04-16 Thread Howland, Curtis
> Nathan Norman - Micromuse Ltd. mailto:[EMAIL PROTECTED] > Gil-galad was an Elven-king.| The Fellowship > Of him the harpers sadly sing: |of > the last whose realm was fair and free | the Ring > between the Mountains and the Sea. | J.R.R. Tolkien A king

RE: on potato's proftpd

2002-04-02 Thread Howland, Curtis
I would bet that the vast majority of "flame wars" begin because someone mistakes "terse" or "concise" for hostility. The reverse, being the endless spewing of meaningless words, all the while saying nothing at all or even the opposite of what it sounds like, is the art of politicians and diplo

RE: on potato's proftpd

2002-04-02 Thread Howland, Curtis
I would bet that the vast majority of "flame wars" begin because someone mistakes "terse" or "concise" for hostility. The reverse, being the endless spewing of meaningless words, all the while saying nothing at all or even the opposite of what it sounds like, is the art of politicians and dipl

RE: failed ssh breakins on my exposed www box ..

2002-03-26 Thread Howland, Curtis
I'm impressed. Even here in Tokyo, where "a cop on ever street corner" is not just an Orwellian slur, the only people who get that kind of service are the ones who directly pay their salaries. Seriously, the only person you can rely on is you. You're the one on the scene, be it a mugging or a c

RE: failed ssh breakins on my exposed www box ..

2002-03-26 Thread Howland, Curtis
I'm impressed. Even here in Tokyo, where "a cop on ever street corner" is not just an Orwellian slur, the only people who get that kind of service are the ones who directly pay their salaries. Seriously, the only person you can rely on is you. You're the one on the scene, be it a mugging or a

RE: weird connection attempt

2002-03-14 Thread Howland, Curtis
Many ISP's do not know enough to filter the RFC1918 space, or only do so on the border routers and not internally. Another good idea is to filter out-going packets by source address, allowing through only those whose source is supposed to be inside the network. Anything with a source of address

RE: weird connection attempt

2002-03-14 Thread Howland, Curtis
Many ISP's do not know enough to filter the RFC1918 space, or only do so on the border routers and not internally. Another good idea is to filter out-going packets by source address, allowing through only those whose source is supposed to be inside the network. Anything with a source of address

RE: dpkg-buildpackage (-rfakeroot) leaves setuid binaries

2002-01-21 Thread Howland, Curtis
For the non-mathmatical, or rather gramatical, style to say it, I use the phrase: "Security is Inconvenient." The first time I say it to someone, they usually pause for a moment, digest it, and it really helps in further discussions about "what to do about...". It's my answer, for instance, wh

RE: dpkg-buildpackage (-rfakeroot) leaves setuid binaries

2002-01-21 Thread Howland, Curtis
For the non-mathmatical, or rather gramatical, style to say it, I use the phrase: "Security is Inconvenient." The first time I say it to someone, they usually pause for a moment, digest it, and it really helps in further discussions about "what to do about...". It's my answer, for instance, wh

RE: IPTABLES

2002-01-09 Thread Howland, Curtis
09, 2002 16:16 > To: Howland, Curtis > Cc: [EMAIL PROTECTED]; Debian-Security > Subject: RE: IPTABLES > > > Just the other way around, 2.2.x == ipchains, 2.4.x == iptables. > > Craig, just look at your kernel, and make sure every > netfilter/iptables > module is compi

RE: IPTABLES

2002-01-09 Thread Howland, Curtis
Please flame me if I have this backwards, but I believe ip_tables only works under 2.2.x and earlier kernels, and the 2.4.x kernel introduced ip_chains and is incompatible with ip_tables. You have to use the right one, even thought the package/module for both shows up (at least in Woody) and lo

RE: IPTABLES

2002-01-08 Thread Howland, Curtis
09, 2002 16:16 > To: Howland, Curtis > Cc: [EMAIL PROTECTED]; Debian-Security > Subject: RE: IPTABLES > > > Just the other way around, 2.2.x == ipchains, 2.4.x == iptables. > > Craig, just look at your kernel, and make sure every > netfilter/iptables > module is compi

RE: IPTABLES

2002-01-08 Thread Howland, Curtis
Please flame me if I have this backwards, but I believe ip_tables only works under 2.2.x and earlier kernels, and the 2.4.x kernel introduced ip_chains and is incompatible with ip_tables. You have to use the right one, even thought the package/module for both shows up (at least in Woody) and l

RE: Secure 2.4.x kernel

2001-12-27 Thread Howland, Curtis
> -Original Message- > From: Gary MacDougall > > I'm gong to get flamed like hell for this, but I think the general > attitude of people that consider themselves "Linux Security > Guru's" sucks! > If you've ever visited #linux on IRC or talked with people in > a chat room > about Linux

RE: Secure 2.4.x kernel

2001-12-27 Thread Howland, Curtis
> -Original Message- > From: Gary MacDougall > > I'm gong to get flamed like hell for this, but I think the general > attitude of people that consider themselves "Linux Security > Guru's" sucks! > If you've ever visited #linux on IRC or talked with people in > a chat room > about Linux

RE: Secure 2.4.x kernel

2001-12-25 Thread Howland, Curtis
l Message- > From: Gary MacDougall [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 26, 2001 11:47 > To: Howland, Curtis; Ralf Dreibrodt > Cc: debian-security@lists.debian.org > Subject: Re: Secure 2.4.x kernel > > > Actually your point of view basically states tha

RE: Secure 2.4.x kernel

2001-12-25 Thread Howland, Curtis
l Message- > From: Gary MacDougall [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, December 26, 2001 11:47 > To: Howland, Curtis; Ralf Dreibrodt > Cc: [EMAIL PROTECTED] > Subject: Re: Secure 2.4.x kernel > > > Actually your point of view basically states that its "ok

RE: Secure 2.4.x kernel

2001-12-25 Thread Howland, Curtis
A major point concerning "laws" is that they prevent nothing. Laws against murder have been around since the idea of "laws" was invented, yet murder still happens. Sometimes in new and spectacular ways. Individual security, be it physical or logical, must be considered an individual responsibil

RE: Secure 2.4.x kernel

2001-12-25 Thread Howland, Curtis
A major point concerning "laws" is that they prevent nothing. Laws against murder have been around since the idea of "laws" was invented, yet murder still happens. Sometimes in new and spectacular ways. Individual security, be it physical or logical, must be considered an individual responsibi

RE: iptables missing library

2001-12-24 Thread Howland, Curtis
This may seem an obvious question, but have you coordinated that "ipchains" works with the 2.2.x kernels, and "iptables" with the 2.4.x kernels? Woody standard kernel is still 2.2.x. Curt- > -Original Message- > From: Jeff [mailto:[EMAIL PROTECTED] > Sent: Tuesday, December 25, 2001 12:

RE: iptables missing library

2001-12-24 Thread Howland, Curtis
This may seem an obvious question, but have you coordinated that "ipchains" works with the 2.2.x kernels, and "iptables" with the 2.4.x kernels? Woody standard kernel is still 2.2.x. Curt- > -Original Message- > From: Jeff [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 25, 2001 12

Another good thing about apt and dselect

2001-12-19 Thread Howland, Curtis
http://www.cnn.com/2001/TECH/internet/12/17/cert.plug.holes.idg/index.ht ml Reading this sort of article reminds me of another really good thing about apt, dselect, and the (forgive me please) Debian Way: I don't have to be told that there is an SSH security fix in order to fix it. Every time I

Another good thing about apt and dselect

2001-12-19 Thread Howland, Curtis
http://www.cnn.com/2001/TECH/internet/12/17/cert.plug.holes.idg/index.ht ml Reading this sort of article reminds me of another really good thing about apt, dselect, and the (forgive me please) Debian Way: I don't have to be told that there is an SSH security fix in order to fix it. Every time I

RE: Spam?!?

2001-12-17 Thread Howland, Curtis
And pleanty of open relay servers, too. obSec: You do have your SMTP transfer agent configured not to act as a relay, right? Curt- -Original Message- From: Petro [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 18, 2001 03:09 To: Yooseong Yang Cc: k l u r t; debian-security@lists.debian

RE: Spam?!?

2001-12-17 Thread Howland, Curtis
And pleanty of open relay servers, too. obSec: You do have your SMTP transfer agent configured not to act as a relay, right? Curt- -Original Message- From: Petro [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 18, 2001 03:09 To: Yooseong Yang Cc: k l u r t; [EMAIL PROTECTED] Subject:

RE: Apt-get is insecure

2001-12-13 Thread Howland, Curtis
Any PGPG keys used by package maintainers will themselves be signed and trusted by the Debian official community. What a "secure apt" must do is alert if the key used is not so trusted, even if it uses the same name and email address as it "should". This assumes that the crackers PGPG key has, som

RE: Apt-get is insecure

2001-12-13 Thread Howland, Curtis
Any PGPG keys used by package maintainers will themselves be signed and trusted by the Debian official community. What a "secure apt" must do is alert if the key used is not so trusted, even if it uses the same name and email address as it "should". This assumes that the crackers PGPG key has, som

RE: How do I disable (close) ports?

2001-12-04 Thread Howland, Curtis
This is one remnant of the "trusted" world of Unix, and the legacy that Linux has to deal with. It's ipchains/iptables to the rescue. I do not have NFS turned on in the kernel modules, nor the package installed. Yet this port is still open *to the outside world*. Can anyone suggest a reason why th

RE: How do I disable (close) ports?

2001-12-04 Thread Howland, Curtis
This is one remnant of the "trusted" world of Unix, and the legacy that Linux has to deal with. It's ipchains/iptables to the rescue. I do not have NFS turned on in the kernel modules, nor the package installed. Yet this port is still open *to the outside world*. Can anyone suggest a reason why th

RE: Secure wu-ftpd for Testing?

2001-11-30 Thread Howland, Curtis
The article I read about it on the Register... http://www.theregister.co.uk/content/4/23082.html "The hole affects thousands of users of virtually every Linux release. Because of the wide implications, Core, working with CERT, and, at on

RE: Secure wu-ftpd for Testing?

2001-11-29 Thread Howland, Curtis
The article I read about it on the Register... http://www.theregister.co.uk/content/4/23082.html "The hole affects thousands of users of virtually every Linux release. Because of the wide implications, Core, working with CERT, and, at on

Encrypted Filesystems zing pow woosh

2001-11-29 Thread Howland, Curtis
Just FYI, Slashdot has a discussionn up on encrypted file systems that might be of interest to folks who partisipated in the discussion here. This direct link might work: http://slashdot.org/article.pl?sid=01/11/28/1549252&mode=thread Curt- --- Curt Howland +81-3-5772-5832

Encrypted Filesystems zing pow woosh

2001-11-29 Thread Howland, Curtis
Just FYI, Slashdot has a discussionn up on encrypted file systems that might be of interest to folks who partisipated in the discussion here. This direct link might work: http://slashdot.org/article.pl?sid=01/11/28/1549252&mode=thread Curt- --- Curt Howland +81-3-5772-5832

Security hole in Linux kernel itself? FW: [FreeBSD-users-jp 65877] Re: nslookup

2001-11-28 Thread Howland, Curtis
Excuse me if this is old hat, has anyone else heard of a vulnerability like this? If it's on the FreeBSD lists, it must be well known... Curt- -Original Message- >From: Kondou, Katsuhiro (IDC) Sent: Wednesday, November 28, 2001 22:16 To: Hu, Geng; Howland, Curtis Subject: Fw:

Security hole in Linux kernel itself? FW: [FreeBSD-users-jp 65877] Re: nslookup

2001-11-28 Thread Howland, Curtis
Excuse me if this is old hat, has anyone else heard of a vulnerability like this? If it's on the FreeBSD lists, it must be well known... Curt- -Original Message- >From: Kondou, Katsuhiro (IDC) Sent: Wednesday, November 28, 2001 22:16 To: Hu, Geng; Howland, Curtis Subject: Fw:

RE: rogue Chinese crawler

2001-11-25 Thread Howland, Curtis
Is there a "drop from..." command as well? I much prefer simply black-holing packets rather than giving back to the perp "I'm here, but I know about you" data by "deny". Or is that what the Apache "deny" does? Curt- -Original Message- From: Christoph Moench-Tegeder [mailto:[EMAIL PROTECT

RE: is 3des secure??

2001-11-25 Thread Howland, Curtis
While this may be whipping a greasy stain on the road, it is true that 3DES was created "by the government" back when private cryptology was difficult or unknown. I believe it is prudent to consider that it was allowed to be used because of practical cracking available to the crypto experts. I'm

RE: rogue Chinese crawler

2001-11-25 Thread Howland, Curtis
Is there a "drop from..." command as well? I much prefer simply black-holing packets rather than giving back to the perp "I'm here, but I know about you" data by "deny". Or is that what the Apache "deny" does? Curt- -Original Message- From: Christoph Moench-Tegeder [mailto:[EMAIL PROTECT

RE: is 3des secure??

2001-11-25 Thread Howland, Curtis
While this may be whipping a greasy stain on the road, it is true that 3DES was created "by the government" back when private cryptology was difficult or unknown. I believe it is prudent to consider that it was allowed to be used because of practical cracking available to the crypto experts. I'm

RE: Mutt & tmp files -- Root is not my Enemy

2001-11-20 Thread Howland, Curtis
There is also this How-To: http://www.linux.org/docs/ldp/howto/Loopback-Encrypted-Filesystem-HOWTO. html I've been thinking that a 100 or 500MB encrypted loop device per user, mounted as a subdirectory under the individual users home, would be effective. It doesn't encrypt the entirety of the dis

RE: Mutt & tmp files -- Root is not my Enemy

2001-11-20 Thread Howland, Curtis
There is also this How-To: http://www.linux.org/docs/ldp/howto/Loopback-Encrypted-Filesystem-HOWTO. html I've been thinking that a 100 or 500MB encrypted loop device per user, mounted as a subdirectory under the individual users home, would be effective. It doesn't encrypt the entirety of the dis

RE: In Praise of Dos (RE: Mutt & tmp files)

2001-11-19 Thread Howland, Curtis
>From: John Galt [mailto:[EMAIL PROTECTED] >delete. You're missing a large point here: root doesn't have to have RWX >access on everything to be able to do their job, -WX may do the trick. So, root does not need total file access in order to do some subset of functions which you, or the NSA, co

RE: In Praise of Dos (RE: Mutt & tmp files)

2001-11-19 Thread Howland, Curtis
>From: John Galt [mailto:[EMAIL PROTECTED]] >delete. You're missing a large point here: root doesn't have to have RWX >access on everything to be able to do their job, -WX may do the trick. So, root does not need total file access in order to do some subset of functions which you, or the NSA, c

In Praise of Dos (RE: Mutt & tmp files)

2001-11-18 Thread Howland, Curtis
To be blunt, I don't think one can entirely protect ones self from root, nor do I believe it's an "All Good" idea. Root Is God. This is a multi-user, full-time, "networked" device. Root bears the responsibility of everything that happens to that machine. They are answerable to everyone, not just o

In Praise of Dos (RE: Mutt & tmp files)

2001-11-18 Thread Howland, Curtis
To be blunt, I don't think one can entirely protect ones self from root, nor do I believe it's an "All Good" idea. Root Is God. This is a multi-user, full-time, "networked" device. Root bears the responsibility of everything that happens to that machine. They are answerable to everyone, not just

RE: Mutt & tmp files -- Root is not my Enemy

2001-11-16 Thread Howland, Curtis
Which reminds me to ask, are the "www.kerneli.org" cryptographic patches applied to the pre-compiled kernels, eg kernel-2-4-14-AMDK6.deb? -Original Message- From: Florian Bantner [mailto:[EMAIL PROTECTED] Sent: Friday, November 16, 2001 16:26 To: debian-security@lists.debian.org Subject:

RE: Mutt & tmp files -- Root is not my Enemy

2001-11-15 Thread Howland, Curtis
Which reminds me to ask, are the "www.kerneli.org" cryptographic patches applied to the pre-compiled kernels, eg kernel-2-4-14-AMDK6.deb? -Original Message- From: Florian Bantner [mailto:[EMAIL PROTECTED]] Sent: Friday, November 16, 2001 16:26 To: [EMAIL PROTECTED] Subject: Re: Mutt & tmp

RE: Mutt & tmp files

2001-11-15 Thread Howland, Curtis
As has been said many times, many ways, once "root" is compromised, all bets are off. Also, the only computer that isn't vulnerable is the one that isn't connected to a network, and can't be physically touched. Did anyone else see that awful Wesley Snipes movie, where he plays a black-bag (pun in

RE: Mutt & tmp files

2001-11-15 Thread Howland, Curtis
As has been said many times, many ways, once "root" is compromised, all bets are off. Also, the only computer that isn't vulnerable is the one that isn't connected to a network, and can't be physically touched. Did anyone else see that awful Wesley Snipes movie, where he plays a black-bag (pun in

RE: Suggestion for debian-security

2001-11-14 Thread Howland, Curtis
I'm glad to hear it. I will forward your message to Debian-Security, where I saw it discussed. Curt- -Original Message- From: Jaakko Niemi [mailto:[EMAIL PROTECTED] Sent: Thursday, November 15, 2001 04:28 To: Howland, Curtis Cc: [EMAIL PROTECTED] Subject: Re: Suggestion for d

RE: Suggestion for debian-security

2001-11-14 Thread Howland, Curtis
I'm glad to hear it. I will forward your message to Debian-Security, where I saw it discussed. Curt- -Original Message- From: Jaakko Niemi [mailto:[EMAIL PROTECTED]] Sent: Thursday, November 15, 2001 04:28 To: Howland, Curtis Cc: [EMAIL PROTECTED] Subject: Re: Suggestion for d

RE: SPAM was RE: INSURE GOOD RECEPTION! VITAL EMERGENCY STRATEGY!!!

2001-11-12 Thread Howland, Curtis
While the traffic load on debian-user, for instance, makes subscribing just to ask one question somewhat hazardous to ones mailspool, I agree with making debian-security "posting by subscriber only". It really isn't "moderating", and doesn't take anyones time. To whom should we address the suggest

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
y off topic no matter how interesting. Thanks to everyone for their help and advice, we shall see. Curt- -Original Message- From: Henrique de Moraes Holschuh [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 13, 2001 09:53 To: Howland, Curtis Cc: debian-security@lists.debian.org Subject: Re: Vulnera

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
ssages from modutils on both boot-up and shutdown about version conflicts and missing modules. Curt- -Original Message- From: Ethan Benson [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 13, 2001 09:33 To: debian-security@lists.debian.org Subject: Re: Vulnerable SSH versions On Tue, N

RE: SPAM was RE: INSURE GOOD RECEPTION! VITAL EMERGENCY STRATEGY!!!

2001-11-12 Thread Howland, Curtis
While the traffic load on debian-user, for instance, makes subscribing just to ask one question somewhat hazardous to ones mailspool, I agree with making debian-security "posting by subscriber only". It really isn't "moderating", and doesn't take anyones time. To whom should we address the sugges

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
01 09:15 To: debian-security@lists.debian.org Subject: Re: Vulnerable SSH versions On Tue, Nov 13, 2001 at 09:02:56AM +0900, Howland, Curtis wrote: > A quick question concerning such things... > > I have a remote server that I do not trust myself to upgrade from > Potato(e) to Woody,

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
A quick question concerning such things... I have a remote server that I do not trust myself to upgrade from Potato(e) to Woody, and such vulnerabilities do worry me a little. Is there any general expectation that such "back porting" will continue once Woody is released? Curt- -Original Mess

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
y off topic no matter how interesting. Thanks to everyone for their help and advice, we shall see. Curt- -Original Message- From: Henrique de Moraes Holschuh [mailto:[EMAIL PROTECTED]] Sent: Tuesday, November 13, 2001 09:53 To: Howland, Curtis Cc: [EMAIL PROTECTED] Subject: Re: Vulnerable SSH versi

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
ssages from modutils on both boot-up and shutdown about version conflicts and missing modules. Curt- -Original Message- From: Ethan Benson [mailto:[EMAIL PROTECTED]] Sent: Tuesday, November 13, 2001 09:33 To: [EMAIL PROTECTED] Subject: Re: Vulnerable SSH versions On Tue, Nov 13, 2001 at

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
2001 09:15 To: [EMAIL PROTECTED] Subject: Re: Vulnerable SSH versions On Tue, Nov 13, 2001 at 09:02:56AM +0900, Howland, Curtis wrote: > A quick question concerning such things... > > I have a remote server that I do not trust myself to upgrade from > Potato(e) to Woody, and such vul

RE: Vulnerable SSH versions

2001-11-12 Thread Howland, Curtis
A quick question concerning such things... I have a remote server that I do not trust myself to upgrade from Potato(e) to Woody, and such vulnerabilities do worry me a little. Is there any general expectation that such "back porting" will continue once Woody is released? Curt- -Original Mes