Re: security.html

2016-09-25 Thread Theo de Raadt
> Hello, > > I have a suggestion to reduce the amount of maintenance work > necessary for errata. > > Why not just have a link to errata.html on the security.html page, > instead of each releases' errata? Each releases' errata is already > accessible on the errata.html page anyway. > > This is

security.html

2016-09-25 Thread bytevolcano
Hello, I have a suggestion to reduce the amount of maintenance work necessary for errata. Why not just have a link to errata.html on the security.html page, instead of each releases' errata? Each releases' errata is already accessible on the errata.html page anyway. This is just a suggestion;

Re: Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Alexander Hall
On Sun, Sep 25, 2016 at 11:29:46PM +0200, Alexander Hall wrote: > On Sun, Sep 25, 2016 at 11:12:56PM +0300, Kihaguru Gathura wrote: > > > B: Section 4 below: Why does running uptime program under chroot yield time > > that is not accurate? 6:54PM while the actual time was 9:54PM produced by > >

Re: Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Alexander Hall
On Sun, Sep 25, 2016 at 11:12:56PM +0300, Kihaguru Gathura wrote: > B: Section 4 below: Why does running uptime program under chroot yield time > that is not accurate? 6:54PM while the actual time was 9:54PM produced by > running uptime as root immediately after. $ man localtime specifically,

Re: Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Kihaguru Gathura
Thank you for ongoing suggestions, The web server in use is OpenBSD httpd and on a private network environment in perspective of security concerns. Kind regards, Kihaguru. On Sun, Sep 25, 2016 at 11:57 PM, Alceu Rodrigues de Freitas Junior < glasswal...@yahoo.com.br> wrote: > Em 25-09-2016

Re: Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Alceu Rodrigues de Freitas Junior
Em 25-09-2016 17:49, Alceu Rodrigues de Freitas Junior escreveu: Last, but not least... not sure why C is your language of choice for CGI. And looks like you're reinventing the wheel: https://httpd.apache.org/docs/2.4/mod/mod_status.html

Re: Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Raul Miller
A simple workaround might be to create a cron script which writes uptime to a file once a minute. If that is inadequate, it's probably worth getting into what problem you are trying to solve. I hope this helps, -- Raul On Sun, Sep 25, 2016 at 4:12 PM, Kihaguru Gathura

Re: Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Alceu Rodrigues de Freitas Junior
Em 25-09-2016 17:12, Kihaguru Gathura escreveu: Hi All, I have a small problem here. I am unable to display uptime online. Yes, you have a conceptual problem. You're doing a CGI that executes a binary. If, by any reason, /usr/bin/uptime is replaced with a malicious program, you're in

Displaying System Uptime via CGI script: not displayed when script is run under chroot.

2016-09-25 Thread Kihaguru Gathura
Hi All, I have a small problem here. I am unable to display uptime online. THE PROBLEM: A: Section 6 below: Why is the system uptime string not displayed when the cgi script is run under chroot? B: Section 4 below: Why does running uptime program under chroot yield time that is not accurate?