Re: [SECURITY] [DSA 1884-1] New nginx packages fix arbitrary code execution

Hi, Nico Golde a écrit : > * Nico Golde [2009-09-14 22:53]: > >> * Jean Christophe André [2009-09-14 20:35]: >> >>> There is some serious dependency problem forbidding the upgrade: >>> [...] >>> >> There was a pro

Re: [SECURITY] [DSA 1884-1] New nginx packages fix arbitrary code execution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi there! Nico Golde a écrit : > For the stable distribution (lenny), this problem has been fixed in version 0.6.32-3+lenny2. There is some serious dependency problem forbidding the upgrade: www:~# LANG= apt-cache show nginx Architecture: i386

Re: Fixing stupid PHP application design flaws

Hans Spaans a Ãcrit : It may be a better idea to start with PHP itself and ask during installation of the users wants to install a secure or insecure version of php4.ini. The same is done with setuid issues for example. Great idea! And I would suggest to have multiple choices, depending on the leve

Re: (no subject)

Le mardi 20 avril 2004 à 12h24 (-0400), [EMAIL PROTECTED] écrivait : > is there a type of listening bug that can be put on a person to here > every thing said If you have some microphone plugged in and somebody has access to your machine, with rights to read /dev/dsp (or any audio input type devic

Re: (no subject)

Le mardi 20 avril 2004 Ã 12h24 (-0400), [EMAIL PROTECTED] Ãcrivait : > is there a type of listening bug that can be put on a person to here > every thing said If you have some microphone plugged in and somebody has access to your machine, with rights to read /dev/dsp (or any audio input type devic

Re: [SECURITY] [DSA 479-2] New Linux 2.4.18 packages fix local root exploit (i386)

Le samedi 17 avril 2004 à 10h01 (-0400), Michael Stone écrivait : > >When you have time, could you please tell people how could that happen? > It's a mistake, it happens. Off course! And I don't ask to blame anybody! I'm just curious to know the details, so it may be usefull to me too when I'm co

Re: [SECURITY] [DSA 479-2] New Linux 2.4.18 packages fix local root exploit (i386)

Le samedi 17 avril 2004 Ã 10h01 (-0400), Michael Stone Ãcrivait : > >When you have time, could you please tell people how could that happen? > It's a mistake, it happens. Off course! And I don't ask to blame anybody! I'm just curious to know the details, so it may be usefull to me too when I'm co

Re: [SECURITY] [DSA 479-2] New Linux 2.4.18 packages fix local root exploit (i386)

Hi Guys! Le mercredi 14 avril 2004 à 23h58 (+0200), Martin Schulze écrivait : > An unfortunate build error caused some of the kernel packages in > DSA 479-1 to be broken. When you have time, could you please tell people how could that happen? Doesn't packaging process has any check for co

Re: [SECURITY] [DSA 479-2] New Linux 2.4.18 packages fix local root exploit (i386)

Hi Guys! Le mercredi 14 avril 2004 Ã 23h58 (+0200), Martin Schulze Ãcrivait : > An unfortunate build error caused some of the kernel packages in > DSA 479-1 to be broken. When you have time, could you please tell people how could that happen? Doesn't packaging process has any check for co

Re: can not kill a process

Le mardi 13 avril 2004 à 12h28 (+0200), Bernd Eckenfels écrivait : > >> 2965 ?RW 3:21 [nopromo] > > This is a zombie process, google is your friend.may the web be with > Zombies are in the Z state, and it helps usually to kill their parents. > RW is running and paging, which should

Re: can not kill a process

Le mardi 13 avril 2004 Ã 12h28 (+0200), Bernd Eckenfels Ãcrivait : > >> 2965 ?RW 3:21 [nopromo] > > This is a zombie process, google is your friend.may the web be with > Zombies are in the Z state, and it helps usually to kill their parents. > RW is running and paging, which should

Re: Antivirus for proxy

> * Raffaele D'Elia wrote: > > This antivirus should protect web clients, not the proxy itself: I'm > > quite sure I've already protected the server choosing debian... Le vendredi 27 février 2004 à 12h38 (+0100), Norbert Tretkowski écrivait : > Try mod_clamav, it's a apache2 module, and it works q

Re: Antivirus for proxy

> * Raffaele D'Elia wrote: > > This antivirus should protect web clients, not the proxy itself: I'm > > quite sure I've already protected the server choosing debian... Le vendredi 27 fÃvrier 2004 Ã 12h38 (+0100), Norbert Tretkowski Ãcrivait : > Try mod_clamav, it's a apache2 module, and it works q

Re: PAM/NIS problem: can't login in with NIS users

Hi, Le jeudi 26 fÃvrier 2004 Ã 16h34 (+0100), Christoph Pohl Ãcrivait : > Now 'ypdomainname' returns the correct domain and 'ypcat passwd' shows > our password db, but i still can't log in as one of those NIS users, > neither local, nor remote (SSH). Check "getent passwd" too, since it

Re: PAM/NIS problem: can't login in with NIS users

Hi, Le jeudi 26 février 2004 à 16h34 (+0100), Christoph Pohl écrivait : > Now 'ypdomainname' returns the correct domain and 'ypcat passwd' shows > our password db, but i still can't log in as one of those NIS users, > neither local, nor remote (SSH). Check "getent passwd" too, since it

Re: [SECURITY] [DSA 443-1] New xfree86 packages fix multiple vulnerabilities

Le vendredi 20 février 2004 à 08h45 (+0100), Adrian 'Dagurashibanipal' von Bidder écrivait : > With the current thread in this list: thanks, Matt & team - I'm quite > satisfies with the way Debian handles security updates currently. I follow on this: I am more than satisfied with the security tea

Re: [SECURITY] [DSA 443-1] New xfree86 packages fix multiple vulnerabilities

Le vendredi 20 fÃvrier 2004 Ã 08h45 (+0100), Adrian 'Dagurashibanipal' von Bidder Ãcrivait : > With the current thread in this list: thanks, Matt & team - I'm quite > satisfies with the way Debian handles security updates currently. I follow on this: I am more than satisfied with the security tea

Re: DSA 438 - bad server time, bad kernel version or information delayed?

Le jeudi 19 février 2004 à 09h24 (+0100), Jan Lühr écrivait : > What about establishing some kind of warning service? E.g. sshd has a well > known serious leak, you should shut it down for the next few days. Warning: the Linux kernel has a well known serious leak, you should shut all your ser

Re: DSA 438 - bad server time, bad kernel version or information delayed?

Le jeudi 19 fÃvrier 2004 Ã 09h24 (+0100), Jan LÃhr Ãcrivait : > What about establishing some kind of warning service? E.g. sshd has a well > known serious leak, you should shut it down for the next few days. Warning: the Linux kernel has a well known serious leak, you should shut all your ser

Re: arpwatch and arp packets ...urgent

Le jeudi 19 février 2004 à 02h55 (+0100), Adam ENDRODI écrivait : > > Another question : > > it is possible to control arp protocol packets by kernel ? > > ... if so - this will solve some of problems. But how control arps? > > perhaps on firewall ? kern 2.4.24/grsec/... > You can adjust the refres

Re: arpwatch and arp packets ...urgent

Le jeudi 19 fÃvrier 2004 Ã 02h55 (+0100), Adam ENDRODI Ãcrivait : > > Another question : > > it is possible to control arp protocol packets by kernel ? > > ... if so - this will solve some of problems. But how control arps? > > perhaps on firewall ? kern 2.4.24/grsec/... > You can adjust the refres

Re: DSA 438 - bad server time, bad kernel version or information delayed?

> On Wed, Feb 18, 2004 at 11:59:06PM +0700, Jean Christophe ANDR? wrote: > > Does any body could tell me why the /boot/vmlinuz-2.4.18-1-686 > > from kernel-image-2.4.18-1-686 version 2.4.18-12.2 is dated > > Feb 1 19:53 instead of today??? Le mercredi 18 février 2004 à 18h06 (+), Steve Kemp é

DSA 438 - bad server time, bad kernel version or information delayed?

Hi Guys! Does any body could tell me why the /boot/vmlinuz-2.4.18-1-686 from kernel-image-2.4.18-1-686 version 2.4.18-12.2 is dated Feb 1 19:53 instead of today??? Regards, -- J.C. "プログフ" ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé techn

Re: DSA 438 - bad server time, bad kernel version or information delayed?

> On Wed, Feb 18, 2004 at 11:59:06PM +0700, Jean Christophe ANDR? wrote: > > Does any body could tell me why the /boot/vmlinuz-2.4.18-1-686 > > from kernel-image-2.4.18-1-686 version 2.4.18-12.2 is dated > > Feb 1 19:53 instead of today??? Le mercredi 18 fÃvrier 2004 Ã 18h06 (+), Steve Kemp Ã

DSA 438 - bad server time, bad kernel version or information delayed?

Hi Guys! Does any body could tell me why the /boot/vmlinuz-2.4.18-1-686 from kernel-image-2.4.18-1-686 version 2.4.18-12.2 is dated Feb 1 19:53 instead of today??? Regards, -- J.C. "" ANDRà <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique rÃgional / Associà techn

Re: How to tell what process accessed a file

el re-compile. See the "acct" package. Regards, -- Jean Christophe André Agence universitaire de la Francophonie - Bureau Asie Pacifique

Re: How to tell what process accessed a file

el re-compile. See the "acct" package. Regards, -- Jean Christophe André Agence universitaire de la Francophonie - Bureau Asie Pacifique -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: security.debian.org

Le mardi 10 février 2004 à 09h19 (+0100), Lupe Christoph écrivait : > > Also see http://www.debian.org/News/2004/20040202 > That's old news. The machine has been reactivated. BTW, could somebody put back the "debian-security -> ." symbolic link? -- J.C. "プログフ" ANDRÉ <[EMAIL PROTECTED]> http://www

Re: security.debian.org

Le mardi 10 fÃvrier 2004 Ã 09h19 (+0100), Lupe Christoph Ãcrivait : > > Also see http://www.debian.org/News/2004/20040202 > That's old news. The machine has been reactivated. BTW, could somebody put back the "debian-security -> ." symbolic link? -- J.C. "" ANDRÃ <[EMAIL PROTECTED]> http://www

Re: Will 2.4.20 Source be patched for the latest kernel vulnerability?

Le mardi 02 décembre 2003 à 12h52 (+0100), Christian Horchert écrivait : > An easy workaround against the brk() issue: Set the address  > space limit to another value than nothing, even a very high  > value. > Add the line > ulimit -v 2147483647 Take care it may not be sufficient! Note the comm

Re: Will 2.4.20 Source be patched for the latest kernel vulnerability?

Le mardi 02 dÃcembre 2003 à 12h52 (+0100), Christian Horchert Ãcrivait : > AnÂeasyÂworkaroundÂagainstÂtheÂbrk()Âissue:ÂSetÂtheÂaddress > space limitÂto anotherÂvalueÂthanÂnothing,ÂevenÂaÂveryÂhigh > value. > AddÂtheÂline > ulimitÂ-vÂ2147483647 Take care it may not be sufficient! Note the comm

Re: Uhm, so, what happened...?

Le vendredi 28 novembre 2003 à 09h36 (-0500), Stephen Frost écrivait : > > It says "Somehow they got root [...]", does anybody yet know how? > Did you *read* what they said? Mhhh... I think so... But I'm not a native english speaker actually... :) Did I miss something? I read this: "(I believe) a

Re: Uhm, so, what happened...?

Le vendredi 28 novembre 2003 Ã 09h36 (-0500), Stephen Frost Ãcrivait : > > It says "Somehow they got root [...]", does anybody yet know how? > Did you *read* what they said? Mhhh... I think so... But I'm not a native english speaker actually... :) Did I miss something? I read this: "(I believe) a

Re: Uhm, so, what happened...?

Le vendredi 28 novembre 2003 à 14h21 (+), Dale Amon écrivait : > > See there: http://www.secunia.com/advisories/10310/ > Yow! TWO GIGABITS OF SEMICOLONS? 2 giga bytes. > One would think someone would notice an attack like > that if it ever occurred! Not necessarly if we can generate it l

Re: Uhm, so, what happened...?

Le vendredi 28 novembre 2003 Ã 14h21 (+), Dale Amon Ãcrivait : > > See there: http://www.secunia.com/advisories/10310/ > Yow! TWO GIGABITS OF SEMICOLONS? 2 giga bytes. > One would think someone would notice an attack like > that if it ever occurred! Not necessarly if we can generate it l

Re: Uhm, so, what happened...?

Le vendredi 28 novembre 2003 à 12h06 (+0100), Boris Stanislavski écrivait : > Subject: more details on the recent compromise of debian.org machines > Date: Fri, 28 Nov 2003 01:04:00 + > http://lists.debian.org/debian-devel-announce/2003/debian-devel-announce-200311/msg00012.html It says "Someh

Re: Uhm, so, what happened...?

Le vendredi 28 novembre 2003 Ã 12h06 (+0100), Boris Stanislavski Ãcrivait : > Subject: more details on the recent compromise of debian.org machines > Date: Fri, 28 Nov 2003 01:04:00 + > http://lists.debian.org/debian-devel-announce/2003/debian-devel-announce-200311/msg00012.html It says "Someh

Re: Uhm, so, what happened...?

Le mercredi 26 novembre 2003 à 17h39 (+0100), Michel Verdier écrivait : > Which time zone ? :) > 17h30 now in Paris, France And 23h46 now in Hanoi, Vietnam ... ;-)) -- J.C. "プログフ" ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Refl

Re: Uhm, so, what happened...?

Le mercredi 26 novembre 2003 à 17h39 (+0100), Michel Verdier Ãcrivait : > Which time zone ? :) > 17h30 now in Paris, France And 23h46 now in Hanoi, Vietnam ... ;-)) -- J.C. "" ANDRà <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique rÃgional / Associà technologie projet Refl

Re: ipsec setkey and 2.4.21 kernel

9 off Missing some net-pf-15 (=> af_key) and probably others... What are the right aliases for esp4 and ah4? Should I go to experimental? ;-) (I'm already using it for XFree86 4.3.0 btw) Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur tech

Re: ipsec setkey and 2.4.21 kernel

9 off Missing some net-pf-15 (=> af_key) and probably others... What are the right aliases for esp4 and ah4? Should I go to experimental? ;-) (I'm already using it for XFree86 4.3.0 btw) Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur tech

Re: ipsec setkey and 2.4.21 kernel

org/Documentation/network/ipsec/ There is plenty of configurations examples, but nothing about this problem. Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universitaire de la

Re: ipsec setkey and 2.4.21 kernel

org/Documentation/network/ipsec/ There is plenty of configurations examples, but nothing about this problem. Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universitaire de la

Re: ipsec setkey and 2.4.21 kernel

test.home 2.4.22-1-686 #6 Sat Oct 4 14:09:08 EST 2003 i686 GNU/Linux # lsmod | grep key af_key 4 0 (unused) Is it necessary? No problem to do it, I'm just missing some time... Oh, one more thing: is it necessary to start racoon event if I won't use IK

Re: ipsec setkey and 2.4.21 kernel

test.home 2.4.22-1-686 #6 Sat Oct 4 14:09:08 EST 2003 i686 GNU/Linux # lsmod | grep key af_key 4 0 (unused) Is it necessary? No problem to do it, I'm just missing some time... Oh, one more thing: is it necessary to start racoon event if I won't use IK

Re: services installed and running "out of the box"

since we most probably installed it for that reason. But I also mean that it should be running *securely*: on loopback only unless configured differently by *user choice*! Best Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régiona

Re: services installed and running "out of the box"

since we most probably installed it for that reason. But I also mean that it should be running *securely*: on loopback only unless configured differently by *user choice*! Best Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régiona

Re: The same debian - different packages

he right way to clean an entry from "/var/lib/dpkg/status"? I've not investigated so "far" until now... :) Is this using "dselect update" or thing like this? (I never use dselect) Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.v

Re: The same debian - different packages

he right way to clean an entry from "/var/lib/dpkg/status"? I've not investigated so "far" until now... :) Is this using "dselect update" or thing like this? (I never use dselect) Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.v

Re: The same debian - different packages

3 0 500 http://security.debian.org woody/updates/main Packages 100 /var/lib/dpkg/status 1:3.4p1-1 0 500 http://ftp.us.debian.org woody/main Packages Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional

Re: The same debian - different packages

urity.debian.org woody/updates/main Packages 100 /var/lib/dpkg/status 1:3.4p1-1 0 500 http://ftp.us.debian.org woody/main Packages Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé tech

Re: Passwordless Authentication (was Re: How to reduce sid security)

go) to do something bad. Any "good" Linux virus would probably try this first... Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universitaire de la Francophonie (AuF) /

Re: Passwordless Authentication (was Re: How to reduce sid security)

go) to do something bad. Any "good" Linux virus would probably try this first... Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universitaire de la Francophonie (AuF) /

Re: Heute abend

Jord Swart écrivait : > Well since this is Debian security all we can say here is: don't forget > your helmet! [EMAIL PROTECTED]:~$ apt-cache search helmet (none found) Argl! Debian won't help this time (even using Sid)! ;-) J.C. -- Jean Christophe ANDRÉ <[EMA

Re: Heute abend

Jord Swart écrivait : > Well since this is Debian security all we can say here is: don't forget > your helmet! [EMAIL PROTECTED]:~$ apt-cache search helmet (none found) Argl! Debian won't help this time (even using Sid)! ;-) J.C. -- Jean Christophe ANDRÉ <[EMA

Re: evolution

. I would call this a "pain" instead of a "feature"... 700 connections in 5 minutes is more than 2 in 1 second... I thought "modern programers" of "modern software" (say evolution) knew about twicing waiting time between each connection failure... J.C. -

Re: evolution

. I would call this a "pain" instead of a "feature"... 700 connections in 5 minutes is more than 2 in 1 second... I thought "modern programers" of "modern software" (say evolution) knew about twicing waiting time between each connection failure... J.C. -

Re: Woody security updates

ntries (I'm in Vietnam) since the Internet access is still expensive for individuals. Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universitaire de la Francophonie (AuF

Re: is the security team overloaded?

ust read it and it is exactly what I was asking for! Thanks for pointing this out! Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universitaire de la Francophonie (AuF) / Bureau

is the security team overloaded?

hem (correctness, compile ok on all architecture, ...) and complete the procedure with a bit less work to do. Just my few cents... J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé technologie projet Reflets Agence universita

Re: determining which patches to apply...

> > apt-get autoclean You may prefer to use the "cron-apt" package (apt-get install cron-apt). The beauty of this is that your upgrade script may also be upgraded! Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régio

Re: determining which patches to apply...

> > apt-get autoclean You may prefer to use the "cron-apt" package (apt-get install cron-apt). The beauty of this is that your upgrade script may also be upgraded! Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régio

Re: question about SSH / IPTABLES

Ralf Dreibrodt écrivait : > Is there any packet filter, which can block only outgoing ssh-sessions? One may use the "string" extension to iptables to match "SSH"? See there: http://www.netfilter.org/documentation/pomlist/pom-extra.html#string Regards, J.C.

Re: question about SSH / IPTABLES

oot them into a filesystem whithout any suid/sgid program 5. Put in this chroot jail only static binaries But far more secure : apt-cache show kernel-patch-2.4-grsecurity Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / As

Re: question about SSH / IPTABLES

Ralf Dreibrodt écrivait : > Is there any packet filter, which can block only outgoing ssh-sessions? One may use the "string" extension to iptables to match "SSH"? See there: http://www.netfilter.org/documentation/pomlist/pom-extra.html#string Regards, J.C. -- To UNSUBSCRIBE, email to [EMAIL

Re: question about SSH / IPTABLES

DEFFONTAINES Vincent wrote: > You can > 1. Remove the users access to the ssh program > (eg change ownership and rights of /usr/bin/ssh and create a "ssh" group for > allowed outgoing ssh users). > 2. Mount /home, /tmp and any other place users might have write access on > with the "noexec" switch,

Re: question about SSH / IPTABLES

r users and what you want to allow them to do. First ask yourself, do I realy need to give them shell access? Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé principal technologie projet Reflets Agence univer

Re: question about SSH / IPTABLES

Hi, Iñaki Martínez écrivait : > I have a server in internet and i want several clients to access to it > via SSH but i DON'T want they to be able to use SSH from that server. > So i client can access the server via SSH, but s/he CAN NOT ssh to other > servers from my server... > How

Re: apache 1.3.27

ebian major release, IMHO... Regards, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé principal technologie projet Reflets Agence universitaire de la Francophonie (AuF) / Bureau Asie-Pacifique (BAP) Adresse postale : AUF,

Re: apache 1.3.27

Hi, Jan H. van Gils écrivait : > When wil apache 1.3.27 be available for Debian Sarge ? > Can somebody please give me an answere on this question. Probably the package maintainer: progfou@virus:~$ apt-cache show apache | grep Maintainer Maintainer: Matthew Wilcox <[EMAIL PROTECTED]>

Re: [SECURITY] [DSA 195-1] New Apache-Perl packages fix several vulnerabilities

! Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé principal technologie projet Reflets Agence universitaire de la Francophonie (AuF) / Bureau Asie-Pacifique (BAP) / Note personnelle : merci d'évitez de m

Re: [SECURITY] [DSA 195-1] New Apache-Perl packages fix several vulnerabilities

! Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé principal technologie projet Reflets Agence universitaire de la Francophonie (AuF) / Bureau Asie-Pacifique (BAP) / Note personnelle : merci d'évitez de m

allowing X display from su'd environment

27;su' feature doing it automagically somewhere (with RedHat, Mandrake or another one)... Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé principal technologie projet Reflets Agence universitaire de la Francoph

allowing X display from su'd environment

ature doing it automagically somewhere (with RedHat, Mandrake or another one)... Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PROTECTED]> http://www.vn.refer.org/ Coordonnateur technique régional / Associé principal technologie projet Reflets Agence universitaire de la Francophonie (AuF) /

Re: port 16001 and 111

Hi, ben écrivait : > way overkill. 16001 isn't being scanned and 111 is the most common target > after 25. you're suggesting that the guy turn his server into a > honeypot--to what end? disable portmap and nothing can get at 111. there's > a difference between simply securing a box and ass

Re: port 16001 and 111

Tom Cook écrivait : > What the > What's wrong with 'lsof -i :111' and 'lsof -i :16001'? Nothing wrong with it! :) > It tells you precisely what's attempting to connect... Yes, except in his case there is no connection since there is no installed daemon on this port, only some connection atte

Re: port 16001 and 111

Hi, ben écrivait : > way overkill. 16001 isn't being scanned and 111 is the most common target > after 25. you're suggesting that the guy turn his server into a > honeypot--to what end? disable portmap and nothing can get at 111. there's > a difference between simply securing a box and ass

Re: port 16001 and 111

Tom Cook écrivait : > What the > What's wrong with 'lsof -i :111' and 'lsof -i :16001'? Nothing wrong with it! :) > It tells you precisely what's attempting to connect... Yes, except in his case there is no connection since there is no installed daemon on this port, only some connection atte

Re: port 16001 and 111

> Jean Christophe ANDRÉ <[EMAIL PROTECTED]> wrote: > > You said "what would try to connect to my system's port [...] 111 > > from within my own system". I would answer "something that is > > configured to do so"? Jussi Ekholm écrivait : >

Re: port 16001 and 111

> Jean Christophe ANDRÉ <[EMAIL PROTECTED]> wrote: > > You said "what would try to connect to my system's port [...] 111 > > from within my own system". I would answer "something that is > > configured to do so"? Jussi Ekholm écrivait : >

Re: port 16001 and 111

Jussi Ekholm écrivait : > The same answer as a luser and as a root. What should I deduct from > this? It's just so weird as I'm not running NFS, NIS or any other > thingie that should use this port... You said "what would try to connect to my system's port [...] 111 from within my own system". I w

Re: port 16001 and 111

Jussi Ekholm écrivait : > The same answer as a luser and as a root. What should I deduct from > this? It's just so weird as I'm not running NFS, NIS or any other > thingie that should use this port... You said "what would try to connect to my system's port [...] 111 from within my own system". I w

Re: postfix in qmail out proftpd in pureftpd

Hi, Dorneles Treméa écrivait : > This is just 'more wood into fire'[1], but take a look at: > http://www.geocrawler.com/mail/msg.php3?msg_id=9506623&list=513 Just looks like: "oh yes, they are rules (say RFC) telling we should drive on the right side of the road, but I discovered that for

Re: Slapper worm does more than infect

Hi, Moses Moore écrivait : > Is there a more efficient way of getting slapper to not grab my webserver > connections? I've considered recompiling apache to get rid of the > "Server:" HTTP response header line completely, but deploying a recompiled > binary (and recompiling every time) acr

Re: postfix in qmail out proftpd in pureftpd

Hi, Dorneles Treméa écrivait : > This is just 'more wood into fire'[1], but take a look at: > http://www.geocrawler.com/mail/msg.php3?msg_id=9506623&list=513 Just looks like: "oh yes, they are rules (say RFC) telling we should drive on the right side of the road, but I discovered that fo

Re: Slapper worm does more than infect

Hi, Moses Moore écrivait : > Is there a more efficient way of getting slapper to not grab my webserver > connections? I've considered recompiling apache to get rid of the > "Server:" HTTP response header line completely, but deploying a recompiled > binary (and recompiling every time) ac

Re: ssh authentication configuration? => better use OTP method

Hello Joshua and all, Joshua Goodall wrote : > Personally I recommend neither and tell everyone to prefer keys > and one-time passwords, but that's another story :) Any hint for the best OTP method on Debian? libpam-opie?? Cheers, J.C. -- Jean Christophe ANDRÉ <[EMAIL PR