Re: Any Account Logs In With Any Password

Depends on your full stack, but yes, this is the PAM behavior as checks prior to this indicate a soft success. If you remove authentication from your system, its expected that any attempt to access will pass, barring and specific denial. --On Monday, October 25, 2010 17:16 -0400 Brad Tilley

Re: non-executable stack (via PT_GNU_STACK) not being enforced

--On Sunday, October 10, 2010 9:53 AM -0400 Brchk05 brch...@aim.com wrote: I am running Debian 2.6.26-21lenny4 and I am puzzled by an issue with the enforcement of page permissions. I have written a simple program with a basic buffer overflow and compiled two versions using gcc: one with

Re: Missing mail.log files

--On March 31, 2009 10:09:37 AM +0200 Giacomo A. Catenazzi c...@debian.org wrote: Consider also that there are different loggers, different way to implement logs and not a right way to do it, so it is really possible to have non-optimal log-rotation scripts. I don't use postfix, so I did

Re: suspicious text alteration

--On February 3, 2009 6:38:19 PM + li...@aleblanc.cotse.net wrote: Hi, I noticed something very suspicious the other day while using emacs. I'm sure I saw a text character on my screen (far from my cursor or mouse pointer) change to a different character on it's own. I have

Re: basically security of linux

--On January 16, 2009 10:31:35 AM +0100 Andreas Matthus andreas.matt...@tu-dresden.de wrote: Hallo, I manage a lot of debian servers and try to install often the updates. So I had in mind my systems are well prepaired. (I follow also other security rules ;-) ) But since some days I mull

Re: basically security of linux

--On January 16, 2009 7:29:13 PM +0100 Johannes Wiedersich johan...@physik.blm.tu-muenchen.de wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Boyd Stephen Smith Jr. wrote: What about hardlinking the suid-root binaries to a hidden location, waiting for a security hole to be

Re: antivirus for webserver

Arjona -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED] -- Michael Loftis Modwest Operations Manager Powerful, Affordable Web Hosting -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble

Re: Apache DDOS with random number request

/DDOS it would be very nice if he can send this to me. Kind Regards -- Andre Braun, IT Manager Turtle Entertainment GmbH -- Michael Loftis Modwest Operations Manager Powerful, Affordable Web Hosting -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe

Re: Mass-updating cached hosts keys afrer ssh security upgrade?

ssh-keyscan --On July 21, 2008 6:43:31 PM -0500 JW [EMAIL PROTECTED] wrote: Hello, In the past several weeks I have applied the openssh/openssl updates to my systems - the updates the fix the random-number-generator weakness. This has turned into an unexpected nightmare: my users have,

Re: [ SPAM! ] [SECURITY] [DSA 1594-1] New imlib2 packages fix arbitrary code execution

--On June 11, 2008 10:44:02 PM +0200 [EMAIL PROTECTED] wrote: Bonjour Je suis absent jusqu'au 16 juin. Vous pouvez envoyer vos demandes à [EMAIL PROTECTED] I am out of the office until june the 16th. You can send your request to [EMAIL PROTECTED] I'm not sure what is worse here. The

Re: openssh lockup after blacklist hits

MaxStartups. --On May 20, 2008 4:15:33 PM +1000 CaT [EMAIL PROTECTED] wrote: I got connections from an unknown IP to openssh today. openssh logged: Public key ... blacklisted (see ssh-vulnkey(1)) 19 times, each time with a different key and then ssh would not respond any more and connections

Re: Kernel upgrade for 3Ware Driver issues?

--On April 22, 2008 11:21:25 PM +0200 Florian Weimer [EMAIL PROTECTED] wrote: I guess the number of systems with amd64 and a 3ware 7xxx/8 PATA controllers is pretty small, otherwise this bug would have been noticed earlier. So the sky is not falling. Technically, this is not a

Kernel upgrade for 3Ware Driver issues?

The 2.6.18-6 kernel has a buggy 3w- driver. Causes data corruption on (at least) EM64T w/ 4+GB of RAM. I'm also pretty sure it's the cause of corruption on EM64T systems in 32-bit mode even w/o 4+GB of RAM. Specifically it affects 7xxx and 8xxx series cards.

Re: Is oldstable security support duration something to be proud of?

--On March 10, 2008 4:33:53 PM -0400 Filipus Klutiero [EMAIL PROTECTED] wrote: Argh. If I'm asking about a statement, that's because I read it. Obviously, the author didn't bother checking whether he was right, which is why I'm asking whether there are some people that disagree.

Re: Why not have firewall rules by default?

--On January 23, 2008 9:19:01 AM -0600 William Twomey [EMAIL PROTECTED] wrote: It's my understanding (and experience) that a Debian system by default is vulnerable to SYN flooding (at least when running services) and other such mischeif. I was curious as to why tcp_syncookies (and similar

Re: Debian suggestion on File Deletion

you will take my suggestion into account. Regards, David -- Michael Loftis Modwest Operations Manager Powerful, Affordable Web Hosting -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: CISP Compliance

PROTECTED] -- Michael Loftis Modwest Operations Manager Powerful, Affordable Web Hosting -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: security mirror out of date: 128.101.240.212

, bad caching resolver that doesn't round-robin it's cached replies. -- Michael Loftis Modwest Operations Manager Powerful, Affordable Web Hosting -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: INFECTED (PORTS: 600)

or distribution of this communication(s) is expressly prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy any and all copies of the original message. Thank you. = -- Michael Loftis Modwest

Re: Debian Kernel security status?

--On April 19, 2006 4:50:27 PM +0200 Jan Luehr [EMAIL PROTECTED] wrote: Hello, looking at the recent vanilla changes, there seem to be a rather rapid development at the moment ;-) and I've to confess, that I lost the overview, what sec-holes do affect debian and which don't. I was

Re: IDS for a non-well-known protocol?

in this area but should be possible.. Any good community's tip? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED] -- Michael Loftis Modwest Operations Manager Powerful, Affordable Web Hosting -- To UNSUBSCRIBE, email to [EMAIL

Re: recent kernel vulnerabilities - debian specific?

--On March 29, 2006 10:19:30 AM +0200 Frank Van Damme [EMAIL PROTECTED] wrote: Hello, I have a question about the recent vulnerabilities in kernel-source-2.6.8. I would like to know if these bugs were specific to Debian and, if not, which versions of the (vanilla) kernel are vulnerable.

Re: [SECURITY] [DSA 1020-1] New flex packages fix insecure code generation

Ouchis anyone anywhere beginning to do an audit of other packages to find out whats affected by this? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: howto block ssh brute-force

reports, and my contacts to sysadmins of originating networks are usually ignored. Any ideas? Maybe there is a way to temporarily block ips upon such attempts (is this a FAQ?), or maybe divert them like what portsentry does for portscans? -- Michael Loftis Modwest Operations Manager Powerful

Re: howto block ssh brute-force

--On March 12, 2006 2:29:09 PM +0100 martin f krafft [EMAIL PROTECTED] wrote: also sprach Michael Loftis [EMAIL PROTECTED] [2006.03.12.1159 +0100]: The only thing I can say is be *VERY* careful on a busy Linux box. iptables sucks. It's sequential, meaning every entry in a list has

Re: Bonk vulnerability!

--On March 3, 2006 10:01:54 AM -0800 Zakai Kinan [EMAIL PROTECTED] wrote: I just installed a server with sarge 3.1 and after testing it with nessus it is vulnerable to bonk. I am trying to figure out how that is possible and how to fix it? My other servers are not vulnerable to bonk. I

Re: Bonk vulnerability!

--On March 3, 2006 1:55:14 PM -0800 Zakai Kinan [EMAIL PROTECTED] wrote: Oh, that is cute. Bonk is similar to teardrop. I was able to use nessus plugin to crash the sarge 3.1 server. Did it actually crash or did nessus just report one? If it crashed what was the Ooops onscreen? This

Re: Using multicast for security updates

Good idea except this requires large scale rollout of mutlicast, which AFAIK, hasn't happened. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Strange Apache log and mambo security - sexy executable

--On January 23, 2006 8:31:40 AM +0100 Maik Holtkamp [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, yesterday morning I found a strange entry in my apache log files (debian sarge, apache 1.3, mambo 4.5.3, kernel 2.4.31). It's a dyndns homelan Server, just

security.debian.org mirrors?

searched the archives and can't find anything relevant. I know that atleast in the past creating ones own mirrors was/is frowned upon but since the security team doesn't seem to be moving in that direction I need to. TIA all, -- Michael Loftis Modwest Operations Manager Powerful, Affordable