audit security

2013-05-14 Thread Pol Hallen
Hi all :-) What should be use to audit security (with email notification) for debian? (with FreeBSD I've portaudit: check from external db security hole from my packages installed and send an email) thanks! Pol -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a su

Re: audit security

2013-05-14 Thread Brian
On Tue 14 May 2013 at 20:22:08 +0200, Pol Hallen wrote: > Hi all :-) > > What should be use to audit security (with email notification) for debian? Apart from subscribing to debian-security-announce? > (with FreeBSD I've portaudit: check from external db security hole f

Re: audit security

2013-05-14 Thread Pol Hallen
> Apart from subscribing to debian-security-announce? Hi and thanks for your reply. I already subscribed to security announce. The difference is that portaudit show me only security hole from installed packages and an email from each server. I've several servers and I can't remember which servic

Re: audit security

2013-05-14 Thread Brad Alexander
It depends on what you are looking for. You could set up Nessus (or nmap or something similar) to run active scans. Nessus has a (free) home feed, as well as a scheduling option. Another front end for it would be Seccubus ( http://seccubus.com/). Something lighter would be tiger, which emails you

Re: audit security

2013-05-14 Thread Brian
On Tue 14 May 2013 at 21:25:16 +0200, Pol Hallen wrote: > > Apart from subscribing to debian-security-announce? > > Hi and thanks for your reply. I already subscribed to security announce. > > The difference is that portaudit show me only security hole from > installed packages and an email from

Re: audit security

2013-05-14 Thread Ralf Mardorf
On Tue, 2013-05-14 at 20:12 +0100, Brian wrote: > On Tue 14 May 2013 at 20:22:08 +0200, Pol Hallen wrote: > > > Hi all :-) > > > > What should be use to audit security (with email notification) for debian? > > Apart from subscribing to debian-security-annou

Re: audit security

2013-05-15 Thread Andrei POPESCU
On Mi, 15 mai 13, 07:07:54, Ralf Mardorf wrote: > > apt-get upgrade > > This command upgrades all installed packages. No, it doesn't. There are occasions (even on stable) where one needs to additionally run 'apt-get dist-upgrade'. However, don't use it unless: - some packages have not been up

Re: audit security

2013-05-15 Thread Ralf Mardorf
On Wed, 2013-05-15 at 11:15 +0300, Andrei POPESCU wrote: > On Mi, 15 mai 13, 07:07:54, Ralf Mardorf wrote: > > > > apt-get upgrade > > > > This command upgrades all installed packages. > > No, it doesn't. There are occasions (even on stable) Thank you, I wasn't aware about this, resp. I didn'

Re: audit security

2013-05-15 Thread Terho Uotila
On Tue, 14 May 2013 20:22:08 +0200 Pol Hallen wrote: > What should be use to audit security (with email notification) for > debian? > > (with FreeBSD I've portaudit: check from external db security hole > from my packages installed and send an email) > As was already po

Re: audit security

2013-05-16 Thread Andrei POPESCU
On Mi, 15 mai 13, 10:39:28, Ralf Mardorf wrote: > > Thank you, > > I wasn't aware about this, resp. I didn't had in mind, that at least > somebody might lock packages. I'm not sure if Debian and Ubuntu do > inform about updates for locked packages. I have no idea what you mean by "locked package

Re: audit security

2013-05-16 Thread Ralf Mardorf
On Thu, 2013-05-16 at 11:25 +0300, Andrei POPESCU wrote: > On Mi, 15 mai 13, 10:39:28, Ralf Mardorf wrote: > > > > Thank you, > > > > I wasn't aware about this, resp. I didn't had in mind, that at least > > somebody might lock packages. I'm not sure if Debian and Ubuntu do > > inform about update

Re: audit security

2013-05-16 Thread Andrei POPESCU
On Jo, 16 mai 13, 10:41:31, Ralf Mardorf wrote: > > For Debian and Ubuntu it's possible to protect packages against > upgrading. I'm not booted to Debian or Ubuntu now, however, for Arch it' > s possible too, Ok, I understand now. However, this has nothing to do with my explanation of dist-upgra

Re: audit security

2013-05-16 Thread Ralf Mardorf
On Thu, 2013-05-16 at 16:07 +0300, Andrei POPESCU wrote: > > IIRC for Debian it's called "lock package" by Synaptic, I don't remember > > how it's called by apt, but Google does help: > > I find it unfortunate that Synaptic Author(s) did not stick to the same > wording as apt/itude/dpkg. Regardi