Your message dated Thu, 07 Mar 2013 13:47:49 +0000
with message-id <[email protected]>
and subject line Bug#671063: fixed in proftpd-dfsg 1.3.5~rc2-1
has caused the Debian Bug report #671063,
regarding proftpd-basic: should renew dhparams.pem file (last updated on
2008-09-07)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
671063: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=671063
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: proftpd-basic
Severity: grave
Tags: security
Justification: user security hole
proftpd-basic ships with a file /etc/proftpd/dhparams.pem with the
following header text:
# Note that these DH parameters should be refreshed every so often (e.g.
# every few years). These parameters were last updated on 2008-09-07.
Seems to me that "few years" have gone by now, and will be long gone by
the end of the supported lifecycle of a stable Debian release.
I understand that the parameters are CPU-hungry to generate (I am trying
right now on a virtual server and only half way through after an hour),
so makes sense to not generate at install time, and probably not at
every build either. I therefore suggest to not install the upstream
provided file but one shipped with the Debian packaging, provide a
custom build target to regenerate that file, and have the normal build
routines check the embedded timestamp and fail if more than one year
old.
Regards,
- Jonas
--- End Message ---
--- Begin Message ---
Source: proftpd-dfsg
Source-Version: 1.3.5~rc2-1
We believe that the bug you reported is fixed in the latest version of
proftpd-dfsg, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Francesco Paolo Lovergine <[email protected]> (supplier of updated
proftpd-dfsg package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 07 Mar 2013 10:23:59 +0100
Source: proftpd-dfsg
Binary: proftpd-basic proftpd-dev proftpd-doc proftpd-mod-mysql
proftpd-mod-pgsql proftpd-mod-ldap proftpd-mod-odbc proftpd-mod-sqlite
proftpd-mod-geoip
Architecture: source i386 all
Version: 1.3.5~rc2-1
Distribution: experimental
Urgency: low
Maintainer: ProFTPD Maintainance Team
<[email protected]>
Changed-By: Francesco Paolo Lovergine <[email protected]>
Description:
proftpd-basic - Versatile, virtual-hosting FTP daemon - binaries
proftpd-dev - Versatile, virtual-hosting FTP daemon - development files
proftpd-doc - Versatile, virtual-hosting FTP daemon - documentation
proftpd-mod-geoip - Versatile, virtual-hosting FTP daemon - GeoIP module
proftpd-mod-ldap - Versatile, virtual-hosting FTP daemon - LDAP module
proftpd-mod-mysql - Versatile, virtual-hosting FTP daemon - MySQL module
proftpd-mod-odbc - Versatile, virtual-hosting FTP daemon - ODBC module
proftpd-mod-pgsql - Versatile, virtual-hosting FTP daemon - PostgreSQL module
proftpd-mod-sqlite - Versatile, virtual-hosting FTP daemon - SQLite3 module
Closes: 671063 679221 699800
Changes:
proftpd-dfsg (1.3.5~rc2-1) experimental; urgency=low
.
* New upstream pre-releaese.
(closes: #671063)
* Refreshed all Debian related patches.
* Do not install ftpasswd.1 anymore.
(closes: #699800)
* Added support for inetutils-inetd. Thanks Mats Erik Andersson.
(closes: #679221)
Checksums-Sha1:
2fcc4b9f8a6f4fcec02788b3a8b6bfbc2afb7e87 2054 proftpd-dfsg_1.3.5~rc2-1.dsc
cf88e971c8188a6c89817c25cd7da9a1223a2ca2 7074831
proftpd-dfsg_1.3.5~rc2.orig.tar.gz
f6170baf65734f07a61aa525a9550d20f810795e 97177
proftpd-dfsg_1.3.5~rc2-1.debian.tar.gz
0d68ce83e7de2fb19af69244f674f34509e245c1 2648066
proftpd-basic_1.3.5~rc2-1_i386.deb
8eef340908e5c20d93ceb7617434b65b90b182c2 1059828
proftpd-dev_1.3.5~rc2-1_i386.deb
615736b8356b7d5deb3e6532a01f8197ba238f35 452046
proftpd-mod-mysql_1.3.5~rc2-1_i386.deb
41433a1dbe260534a659d194468a9031bd9eec26 451722
proftpd-mod-pgsql_1.3.5~rc2-1_i386.deb
8244395acc323a1e466d8aaec5845592a2986168 460296
proftpd-mod-ldap_1.3.5~rc2-1_i386.deb
841eacc390e321b680853c705eacdc01c60c8008 453364
proftpd-mod-odbc_1.3.5~rc2-1_i386.deb
c2ef33d8c977af5f9aa38522ec95edbe8db1dd7f 451210
proftpd-mod-sqlite_1.3.5~rc2-1_i386.deb
fad556de0af02dfc1dd7251075aac0796123f070 452568
proftpd-mod-geoip_1.3.5~rc2-1_i386.deb
faa2db104053cec4ebd9bf35937f4a92ed1aac69 1037546
proftpd-doc_1.3.5~rc2-1_all.deb
Checksums-Sha256:
09c0ba95fdff8291c17379a074918914d30580ac8dcbb80ecb4433b2299973bd 2054
proftpd-dfsg_1.3.5~rc2-1.dsc
53ef7008c20c8a497a0f590a09f9b9380dd1592a5c82f4d37cf5c47e3395e9c1 7074831
proftpd-dfsg_1.3.5~rc2.orig.tar.gz
5372d7142f3627618f8f249feb702eae4566aae8a02d287204f513c94f3d5379 97177
proftpd-dfsg_1.3.5~rc2-1.debian.tar.gz
e5f054474893ab6cfb1ff201b266f81e17865cfaa29001b4a473bae2a01b2754 2648066
proftpd-basic_1.3.5~rc2-1_i386.deb
78ad8fcec63101a7b480b4c56fb0d1d5e16ec1091a14b97a5d1f047e7b54a003 1059828
proftpd-dev_1.3.5~rc2-1_i386.deb
eede337bba7ee989b9225cc3289ff8e0299eb550d687ff165c1b43cfb6435572 452046
proftpd-mod-mysql_1.3.5~rc2-1_i386.deb
35cc102fd64287b770cdfd0135b90dbf21c40b31d8debcd3a8837be2b2fe4b45 451722
proftpd-mod-pgsql_1.3.5~rc2-1_i386.deb
fcbddc9d4e90ab66003e60941566641f0cb42d3dbf065c0a75b5626398d4e014 460296
proftpd-mod-ldap_1.3.5~rc2-1_i386.deb
d03f85447757a64308718d09367c002edcb6ab9df5c2a9914578bbafc591fdde 453364
proftpd-mod-odbc_1.3.5~rc2-1_i386.deb
1ec14969a628b5f216692cefe6be1a94116f0dc612e8323eb857c39afa90f106 451210
proftpd-mod-sqlite_1.3.5~rc2-1_i386.deb
acd2d1fd9674cfc892acf9f6d2cbc6252bcd8e01fca9a0d4885307a20a94f56d 452568
proftpd-mod-geoip_1.3.5~rc2-1_i386.deb
ad9d46c34c1629ea598a4e0ce7d0b1b97b6d53aa8d93e7953c97946041251735 1037546
proftpd-doc_1.3.5~rc2-1_all.deb
Files:
0a6ffe89c2082a7383ee1dfc948fd514 2054 net optional proftpd-dfsg_1.3.5~rc2-1.dsc
c2a57664c693f4869978a938df56e328 7074831 net optional
proftpd-dfsg_1.3.5~rc2.orig.tar.gz
c5e2a234af4f3cf6c5ad309adceb0fba 97177 net optional
proftpd-dfsg_1.3.5~rc2-1.debian.tar.gz
4c0140c810d8762b9b3363b1f5a3d80d 2648066 net optional
proftpd-basic_1.3.5~rc2-1_i386.deb
a092fcbbf41ee78dfa67f3a3c9acde1a 1059828 net optional
proftpd-dev_1.3.5~rc2-1_i386.deb
f6848e63a4dc777542c73f476493e560 452046 net optional
proftpd-mod-mysql_1.3.5~rc2-1_i386.deb
57d74b24f1cb9b7493e5bb333c08d106 451722 net optional
proftpd-mod-pgsql_1.3.5~rc2-1_i386.deb
fd4afe8e7664229be9a89b96b4f02c4d 460296 net optional
proftpd-mod-ldap_1.3.5~rc2-1_i386.deb
dcc033650aef10a87da3f861e9198810 453364 net optional
proftpd-mod-odbc_1.3.5~rc2-1_i386.deb
5a20f2c4a464501ff176690202ed4ae1 451210 net optional
proftpd-mod-sqlite_1.3.5~rc2-1_i386.deb
3130a00d638117d407f6f1744c3e4917 452568 net optional
proftpd-mod-geoip_1.3.5~rc2-1_i386.deb
2eb7c827d058d441da33b7b15a66f37f 1037546 doc optional
proftpd-doc_1.3.5~rc2-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlE4mTkACgkQpFNRmenyx0fLqACfcNJoG6Kv/GkKODe2eV7Wn97N
kcIAoNywQvoTL9uhXXVDapygpMUScwZY
=Z61E
-----END PGP SIGNATURE-----
--- End Message ---
