Bob,
Right now the three biggest security threats to Linux are...
1/ not having wu-ftpd installed with the latest fixed version
wu-ftpd-2.6.1-7mdk
2/ using sunrpc port 111 for NFS (stat.d exploit)
3/ using an older version of bind/named (DNS)
bind-8.2.2P7-1.1mdk
bind-utils-8.2.2P7-1.1mdk
Check out the 7.1 *AND* 7.2 updates/ on your closest mirror site.
Be sure to update ALL packages that you have installed on your server.
Join the Mandrake security list for warnings on vulnerable packages
and then get the updates.
Email me direct with your server IP if you would like me to audit
your server or offer any other suggestions.
> Last night, my webserver machine (Mandrake 7.1) was "defaced". The
> hacker got root access, and uploaded a script that went into every
> virtual host and replaced the index.htm(l) file with his own file. His
> "defacement" included his email, and a link to his site:
> http://rsh.defacements.com
> ...
> So... what can a 7.1 user do to get the wu-ftp 2.6.1???
Here's what I did last week to get it installed...
> > I am trying to install 'wu-ftpd-2.6.1-7mdk.i586.rpm' which depends on
> > error: failed dependencies:
> > xinetd is needed by wu-ftpd-2.6.1-7mdk
> >
> > I got xinetd-2.1.8.9pre12-2mdk.i586.rpm from current 7.2 version.
> > When trying to install xinet*, I get ...
> > # rpm -ivh xinet*
> > error: failed dependencies:
> > /etc/init.d is needed by xinetd-2.1.8.9pre12-2mdk
> >
> > Why is it looking for /etc/init.d instead of /etc/rc.d/init.d
> > on my LM7.1 system ? (I see nothing relevant in the changelog).
>
> Because of fhs compliance you need things like this.
> Install latest filesystem /initscripts and things should be gone.
> Be careful since these are base system packate, just warning so that you don't
> screw your system ..
I got the 7.2 version of initscripts-5.27-37mdk
and updated my 7.1 system and it works.
I was then able (from 7.2) to install xinetd-2.1.8.9pre12-2mdk
and update wu-ftpd-2.6.1-7mdk
# rpm -ivh xinetd-2.1.8.9pre12-2mdk
# rpm -Uvh wu-ftpd-2.6.1-7mdk
Thanks... Dan.
Keep in touch with http://mandrakeforum.com:
Subscribe the "[EMAIL PROTECTED]" mailing list.
