How would updating ssh bring down a production system? http://www.gilliss.com/cgi-bin/presentation?title=Building+a+Backdoor+Binary&; name=Backdoor&total=49&rank=1
When I was writing this, I found *lots* of instances where the coding (mine, unfortunately) left the daemon(s) lying around doing gawd knows what on the system (and you hung your session besides). Console was the only reason that I got the code working so that I could do the presentation (not that I'd ever trojan an sshd on a system, for educational purposes only, ...) G On or about 2003.11.14 21:10:04 +0000, [EMAIL PROTECTED] ([EMAIL PROTECTED]) said: > Well, *that* particular one is unlikely. But I've seen it happen. > > You install a borked build of ssh (shared lib dependencies are FUN), > restart it, your session goes bye-bye, and you can't get back in to > fix the runaway sshd that's chewing all the resources.... > > The more generic point is that in larger shops, you usually need to get > *everything* planned and OK'ed in advance, including backout plans. And > even then things go wrong. > > I'm sure I'm not the only sysadmin who's SSH'ed in to an ill box, decided > a reboot was needed, and typed 'shutdown -i6 -g0 -y' (runlevel 6 to reboot, > zero seconds grace, and don't prompt me), and instead realized 7 seconds > later that what the other end *received* was '-i0 -g6 -y' (poweroff with > 6 seconds warning), and made a bad situation worse. > > What *I*'d like to know is how the transposition gremlins know that it's > 2AM on a major holiday, or a snowstorm, or other reason that the NOC is > running lights-out and nobody's there to push the button to power it back on.. -- Gregory A. Gilliss, CISSP E-mail: [EMAIL PROTECTED] Computer Security WWW: http://www.gilliss.com/greg/ PGP Key fingerprint 2F 0B 70 AE 5F 8E 71 7A 2D 86 52 BA B7 83 D9 B4 14 0E 8C A3 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
