package signing [on topic version, and maybe keep it that way]

Before the previous thread turned all that useful energy into waste heat, the author raised an interesting point: What support do .debs have for package signing right now? Thanks, Adam

Re: Review: sect. 4.16.2 of the Securing Debian manual

Note that you must also prevent raw disk access by the superuser as well. If I were securing a system, I think I'd opt for offline storage of logs (line printer, serial line, WORM/CDR driver, write-only network logging to a "secure" machine.) Trying to protect the local system from the superuser

Re: [despammed] Re: Secure remote syslogging?

You could hardcode the MAC using static arp entries. Also, you could just broadcast on the logger interface (which doesn't require an ARP lookup, it just uses the broadcast MAC). My concerns with this approach (although I like the sound of it) is that it might fsck up your media detection (eg: is

Re: Someone scanned my ssh daemon

t; > iD8DBQE+7QqJL/zYpWVgapgRAlKNAJ9ttp2EXJTQOM0zbt4QxP9+9035FgCfecVc > gIRXdU/bu7D5WN/1s1La4Is= > =NZ2c > -END PGP SIGNATURE- -- Adam Lydick <[EMAIL PROTECTED]>

services installed and running "out of the box"

need it, rather then to need to remember to turn something off that you aren't using? Thanks, Adam Lydick

Re: services installed and running "out of the box"

Agreed. The X maintainers (as one example) started doing that a while back. I run exim and a few other services like this (manually configured, sadly). On Wed, 2003-09-24 at 15:04, Florian Weimer wrote: > On Wed, Sep 24, 2003 at 01:42:01PM -0700, Adam Lydick wrote: > > > Is there a

Re: services installed and running "out of the box"

eboot: you have to > set them up manually. > > Might be worth a look to see how they did it to see if it can be easily > implemented on debian? > > > On Thu, 25 Sep 2003 10:04, Florian Weimer wrote: > > On Wed, Sep 24, 2003 at 01:42:01PM -0700, Adam Lydick wrote: &g

Re: services installed and running "out of the box"

I haven't done more then look at the screen shots for it, but the "personal firewall" (eg: iptables frontend) that comes with RH9 looks to be default deny for most incoming traffic while providing a nice (read: graphical and straightforward) way to punch essential holes through it as needed. (and o

Re: Fwd: Cron apt-get update && apt-get -y upgrade

Also note that if those packages actually did contain malicious code, uninstalling is a totally pointless exercise. I rather doubt that an attacker is going to be kind enough to add a remove script for their rootkit ;) (I've seen two different people say some variation of this, so I thought I ough

package signing [on topic version, and maybe keep it that way]

Before the previous thread turned all that useful energy into waste heat, the author raised an interesting point: What support do .debs have for package signing right now? Thanks, Adam -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTE

Re: Review: sect. 4.16.2 of the Securing Debian manual

Note that you must also prevent raw disk access by the superuser as well. If I were securing a system, I think I'd opt for offline storage of logs (line printer, serial line, WORM/CDR driver, write-only network logging to a "secure" machine.) Trying to protect the local system from the superuser

Re: Someone scanned my ssh daemon

t; > iD8DBQE+7QqJL/zYpWVgapgRAlKNAJ9ttp2EXJTQOM0zbt4QxP9+9035FgCfecVc > gIRXdU/bu7D5WN/1s1La4Is= > =NZ2c > -END PGP SIGNATURE- -- Adam Lydick <[EMAIL PROTECTED]> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

services installed and running "out of the box"

need it, rather then to need to remember to turn something off that you aren't using? Thanks, Adam Lydick -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: services installed and running "out of the box"

Agreed. The X maintainers (as one example) started doing that a while back. I run exim and a few other services like this (manually configured, sadly). On Wed, 2003-09-24 at 15:04, Florian Weimer wrote: > On Wed, Sep 24, 2003 at 01:42:01PM -0700, Adam Lydick wrote: > > > Is there a

Re: services installed and running "out of the box"

eboot: you have to > set them up manually. > > Might be worth a look to see how they did it to see if it can be easily > implemented on debian? > > > On Thu, 25 Sep 2003 10:04, Florian Weimer wrote: > > On Wed, Sep 24, 2003 at 01:42:01PM -0700, Adam Lydick wrote: &g

Re: services installed and running "out of the box"

I haven't done more then look at the screen shots for it, but the "personal firewall" (eg: iptables frontend) that comes with RH9 looks to be default deny for most incoming traffic while providing a nice (read: graphical and straightforward) way to punch essential holes through it as needed. (and o

Re: Fwd: Cron apt-get update && apt-get -y upgrade

Also note that if those packages actually did contain malicious code, uninstalling is a totally pointless exercise. I rather doubt that an attacker is going to be kind enough to add a remove script for their rootkit ;) (I've seen two different people say some variation of this, so I thought I ough

Re: [meta] Set reply-to to something else?

Better to bounce or moderate entries from non-subscribers, IMOHO. That would cut down on the spam quite a lot better than probabilistic filters as well. There are probably reasons why this hasn't been done, although most non-debian mailing lists seem to take this approach (and see none of the nois