[PLUG] Re: apt-get / rpm freshmeat article

[Kevin Falcone <kevinfal@seas.upenn.edu>]

>>>>> "MWR" == Michael W Ryan <mryan@netaxs.com> writes:

  MWR> what is the "insecurity" that people are citing in
  MWR> distributions?  Is this a concrete problem or a hobgoblin?

For example.  My ISP set up their own name server after much prodding,
and they just slapped a copy of RedHat 6.1 on an old pentium,
installed BIND, and went on their merry little way.

This machine had exploitable versions of ftpd, imapd, portmapp, statd,
lockd, and it even had inn and popd set up.  It has since been killed
back to ssh and named.

Now, why in the world would all of those be on in the default install?

Personally, the first thing I do after an install is kill inetd until I
have had a chance to prune many of these things.

Oh, and for those of us who do use RPM based systems, I recently got
the keys to a VALinux server which has autorpm running on it.  Pretty
neat, as it points out that there are new RPMs for me to grab when I
wake up in the morning.

-kevin

-- 
Ah, young webmaster... java leads to shockwave. Shockwave leads to realaudio.
And realaudio leads to suffering. 
Peter da Silva in <7imj5e$dcl@web.nmti.com>


______________________________________________________________________
Philadelphia Linux Users Group       -      http://www.phillylinux.org
Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
General Discussion  -  http://lists.phillylinux.org/mail/listinfo/plug