On Fri, Mar 05, 2021 at 02:51:47PM +, Mike Gabriel wrote:
> the correct fix to scanlogd.init is this:
> +chown scanlogd:nogroup $RDIR
> +chown root:root $RDIR/empty
No, this is still incorrect, as I explained in another message (I
realize you sent this one before you could see mine).
Hi Mike,
Thank you for creating the bug.
On Fri, Mar 05, 2021 at 02:32:54PM +, Mike Gabriel wrote:
> if [ ! -d $RDIR/empty ]; then
> mkdir -p $RDIR/empty
> -chown -R scanlogd:nogroup $RDIR
> +chown scanlogd:nogroup $RDIR
> +chown root:root $RDIR/empty
> fi
> @Alexander:
On Thu, Jul 14, 2016 at 04:02:18PM -0400, Jim Paris wrote:
> The passwdqc module fails with a segmentation fault. This is because,
> in non-unix mode, pam_sm_chauthtok builds up a fake "struct passwd" on
> the stack:
This bug is now fixed in upstream passwdqc 1.3.1, as announced here:
Hi Jim,
On Thu, Jul 14, 2016 at 04:02:18PM -0400, Jim Paris wrote:
> With a pam configuration like:
>
> password required pam_passwdqc.so min=disabled,8,8,7,7 retry=1 non-unix
> random=32 enforce=users
>
> The passwdqc module fails with a segmentation fault. This is because,
> in non-unix
Hi,
I haven't been watching this discussion closely, but here are some
comments that might be of help:
On Fri, Aug 26, 2011 at 11:07:20AM +0200, Yves-Alexis Perez wrote:
Would something like:
diff --git a/src/dmrc.c b/src/dmrc.c
index bff1da8..9f38faf 100644
--- a/src/dmrc.c
+++
Hi Kees,
On Mon, Aug 24, 2009 at 07:04:01PM -0700, Kees Cook wrote:
It seems that john is built (in some situation) against assembly code that
lack stack markings[1]. This results in the entire program being built
with an executable stack.
The attached patch solve this by adding a default
Debian fixed this bug incorrectly. CLOCKS_PER_SEC is not a correct
substitute for CLK_TCK. Please see:
http://www.openwall.com/lists/xvendor/2006/04/17/1
To make matters worse, the glibc documentation is buggy:
http://sources.redhat.com/bugzilla/show_bug.cgi?id=2636
For scanlogd, the correct
On Wed, Aug 27, 2008 at 09:06:58AM +0200, Julien Valroff wrote:
Do you suggest that using /var/run/rkhunter-debug is better
than /tmp/rkhunter-debug. (created using mktemp)?
Yes - primarily from usability standpoint. This time, having a fixed
filename is better, and since rkhunter
FWIW, I happened to independently notice this and report it upstream a
week ago:
https://sourceforge.net/tracker/?func=detailatid=794190aid=1971965group_id=155034
While I am at it, I suggest that you change /tmp/rkhunter-debug to
/var/run/rkhunter-debug. Right now, you have a security hole
Disclaimer: I am not a Debian user, I merely wrote JtR.
My understanding is that some supported versions of Debian continue to
use the ancient JtR 1.6, released over 8 years ago. I recommend that
you start by updating to JtR 1.7+, which includes system-wide
installation support. IIRC, this was
10 matches
Mail list logo
