Re: [SECURITY] [DSA 1783-1] New mysql-dfsg-5.0 packages fix multiple vulnerabilities

2009-04-29 Thread Giacomo A. Catenazzi
Devin Carraway wrote: - Debian Security Advisory DSA-1783secur...@debian.org http://www.debian.org/security/ Devin Carraway April 29, 2009http://www.debia

Re: Missing mail.log files

2009-03-31 Thread Giacomo A. Catenazzi
Walton, Bryan K wrote: Is it possible that during the daily syslog rotation that some log files were deleted somehow? Anybody ever seen this? Am I being too paranoid? Or not paranoid enough? I would love to blame this on the savelog cron job. It could be possible. It is often an impossible t

Re: Exploit in Upgrade Chain?

2009-02-12 Thread Giacomo A. Catenazzi
Boyd Stephen Smith Jr. wrote: On Wednesday 11 February 2009 23:26:45 Stan Katz wrote: I updated/upgraded both my AMD64 and AMD k6 "Etch" machines between Feb 10-11, 2009 using "Lenny" test. Both picked up a symptom I haven't seen since the lpd exploit of the 1990's. This symptom manifests itself

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Giacomo A. Catenazzi
Mark Brown wrote: On Thu, Aug 28, 2008 at 01:05:19PM +0200, Johan Walles wrote: 2008/8/28 Giacomo A. Catenazzi <[EMAIL PROTECTED]>: auth.log was invented for this reason, and separated to standard log: it should be readable only by root, because users do errors. It's readable

Re: Fwd: Password leaks are security holes

2008-08-28 Thread Giacomo A. Catenazzi
Johan Walles wrote: Hi Nico! Let's keep debian-security in the discussion to see what others have to say about this. Technically I agree with you when you say that people shouldn't enter anything but their usernames at the login prompt, but the fact is that people (like me and the bug submitter

Re: Time to replace MD5?

2007-06-13 Thread Giacomo A. Catenazzi
Mike Hommey wrote: On Wed, Jun 13, 2007 at 10:37:26AM -0300, Henrique de Moraes Holschuh <[EMAIL PROTECTED]> wrote: On Wed, 13 Jun 2007, Florian Weimer wrote: On Tue, 12 Jun 2007, Touko Korpela wrote: Debian Security Advisories currently contain MD5 checksums. As MD5 is no longer strong enoug

Re: iptables and nmap

2007-06-08 Thread Giacomo A. Catenazzi
Joan Hérisson wrote: Chain INPUT (policy DROP 17 packets, 1088 bytes) pkts bytes target prot opt in out source destination 164 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 225 18816 bad_tcp_packets tcp --

Re: iptables and nmap

2007-06-07 Thread Giacomo A. Catenazzi
Joan Hérisson wrote: Hello, Config: - Debian 2.4.18 - iptables with many rules Problems: - I have installed a tomcat 5.5 server. The server is unreachable (connection failed from locahost or another host on my local network). Tries: - I have to open port 8080. I have this rule in /etc/init.d

Re: debian.org DNSs allow unrestricted zone transfers

2007-05-15 Thread Giacomo A. Catenazzi
martin f krafft wrote: also sprach Giacomo A. Catenazzi <[EMAIL PROTECTED]> [2007.05.15.1646 +0200]: the theory: zone transfer of a DNS gives internal information about structure and IPs of internal machines. my theory: that information should be public, or at least if it were, the n

Re: debian.org DNSs allow unrestricted zone transfers

2007-05-15 Thread Giacomo A. Catenazzi
martin f krafft wrote: also sprach Abel Martín <[EMAIL PROTECTED]> [2007.05.15.1356 +0200]: I thought zone transfers should only be possible between DNSs which have records for the same domain, so why are debian.org DNSs (raff, rietz, klecker) allowing zone transfers? Maybe I'm paranoid, but I t

Re: init scripts and su

2004-07-28 Thread Giacomo A. Catenazzi
Russell Coker wrote: On Tue, 27 Jul 2004 07:48, Andrew Pimlott <[EMAIL PROTECTED]> wrote: Maybe your changes should happen in su by default, with a --leak-tty option if you want to keep the terminal. I can't imagine us changing the way su works by default. The only way to make "su user" not have