Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Richard A Nelson
In the non-unix world, telnet is still a necessity :( Yes, I have putty on *my* windows boxen... But there are still significant numbers of boxes that I use - MVS/VM (z/OS), W2k, etc. that require me to allow directed telnet to my laptop/workstation. Just because there is a H2 on the block,

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Rick Moen
Quoting Richard A Nelson ([EMAIL PROTECTED]): Yes, I have putty on *my* windows boxen... But there are still significant numbers of boxes that I use - MVS/VM (z/OS)... OpenSSH works on MVS. See: http://www.stdnet.com/uploads/media/MOVEit-DMZ-Compatible-Clients.PDF. , W2k, etc. Innumerable

Re: Rebuilding packages on *all* architectures

2004-09-25 Thread martin f krafft
also sprach Russell Coker [EMAIL PROTECTED] [2004.09.24.1653 +0200]: But what if the source is modified? Taking over a DD's machine and modifying the source tree that is used to make the .diff.gz shouldn't be impossible. We don't have any source auditing processes that could deal with this.

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Jan Minar
On Fri, Sep 24, 2004 at 04:15:09PM -0600, s. keeling wrote: Is anyone still using telnet when there's ssh? Why? I wouldn't even use it inside my own firewalled LAN. ssh is just better. I've been told telnet *does* make a lot of sense where IPSEC is set up. Cheers, -- Jan

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread hanasaki
Jan Minar wrote: On Fri, Sep 24, 2004 at 04:15:09PM -0600, s. keeling wrote: Is anyone still using telnet when there's ssh? Why? I wouldn't even use it inside my own firewalled LAN. ssh is just better. I've been told telnet *does* make a lot of sense where IPSEC is set up. Cheers, When IPSEC

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Richard A Nelson
On Sat, 25 Sep 2004, Rick Moen wrote: Quoting Richard A Nelson ([EMAIL PROTECTED]): Yes, I have putty on *my* windows boxen... But there are still significant numbers of boxes that I use - MVS/VM (z/OS)... OpenSSH works on MVS. See:

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Rick Moen
Quoting Richard A Nelson ([EMAIL PROTECTED]): [Snip MVS mainframe priesthood standing in way of OpenSSH installation.] I typically use cygwin on *MY* laptop, but when away from that - I try not to install random software on other's boxen The usual remedy is to pull down putty.exe (tiny) and

Debian Hardened project status.

2004-09-25 Thread Lorenzo Hernandez Garcia-Hierro
Hi, I've started a few time ago (as many of you could know) the Debian Hardened project , as an approach to Debian's mainline security. Currently, the project is in a mature state of development with many things already done and also a lot of testing of the work. I've ported to Debian Sarge's

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Dale Amon
On Sat, Sep 25, 2004 at 10:34:43AM -0500, hanasaki wrote: Jan Minar wrote: On Fri, Sep 24, 2004 at 04:15:09PM -0600, s. keeling wrote: Is anyone still using telnet when there's ssh? Why? I wouldn't even use it inside my own firewalled LAN. ssh is just better. I've been told telnet *does*

Re: telnetd vulnerability from BUGTRAQ

2004-09-25 Thread Milan Jurik
Hi, On Sat, 25 Sep 2004, Rick Moen wrote: Quoting Richard A Nelson ([EMAIL PROTECTED]): The point remains that while telnet/ftp should be treated as deprecated when feasible, sometimes there just aren't alternatives. My entire document (http://linuxmafia.com/ssh) is devoted to