Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Don Lewis wrote: > On 13 Jun, Michelle Sullivan wrote: > > >> SSH would be the biggie that most security departments are scared of... >> > > Well, ssh is available in ports, though I haven't checked to see that it > picks up the correct version of openssl. > > Problem is it doesn't have

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Matt Smith
On Jun 13 13:13, Michelle Sullivan wrote: Don Lewis wrote: On 13 Jun, Michelle Sullivan wrote: SSH would be the biggie that most security departments are scared of... Well, ssh is available in ports, though I haven't checked to see that it picks up the correct version of openssl. Probl

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Matt Smith wrote: > On Jun 13 13:13, Michelle Sullivan wrote: >> Don Lewis wrote: >>> On 13 Jun, Michelle Sullivan wrote: >>> >>> SSH would be the biggie that most security departments are scared of... >>> >>> Well, ssh is available in ports, though I haven't checked to see >>> that

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Carmel NY
On Sat, 13 Jun 2015 12:36:44 +0100, Matt Smith stated: >The other alternatives are as you say, put /usr/local/bin before >/usr/bin in the $PATH. Or add an alias for commands like ssh to point to >the ports version. These methods aren't quite as clean though. Swapping the PATH can, in a few inst

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Carmel NY wrote: > On Sat, 13 Jun 2015 12:36:44 +0100, Matt Smith stated: > > >> The other alternatives are as you say, put /usr/local/bin before >> /usr/bin in the $PATH. Or add an alias for commands like ssh to point to >> the ports version. These methods aren't quite as clean though. >>

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Carmel NY
On Sat, 13 Jun 2015 14:48:04 +0200, Michelle Sullivan stated: >Carmel NY wrote: >> On Sat, 13 Jun 2015 12:36:44 +0100, Matt Smith stated: >> >>> The other alternatives are as you say, put /usr/local/bin before >>> /usr/bin in the $PATH. Or add an alias for commands like ssh to point to >>> the

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Carmel NY wrote: > On Sat, 13 Jun 2015 14:48:04 +0200, Michelle Sullivan stated: > > >> Carmel NY wrote: >> >>> On Sat, 13 Jun 2015 12:36:44 +0100, Matt Smith stated: >>> >>> The other alternatives are as you say, put /usr/local/bin before /usr/bin in the $PATH. Or add an

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Carmel NY
On Sat, 13 Jun 2015 14:48:04 +0200, Michelle Sullivan stated: >Carmel NY wrote: >> On Sat, 13 Jun 2015 12:36:44 +0100, Matt Smith stated: >> >> >>> The other alternatives are as you say, put /usr/local/bin before >>> /usr/bin in the $PATH. Or add an alias for commands like ssh to point to >>>

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Don Lewis
On 13 Jun, Michelle Sullivan wrote: > Matt Smith wrote: >> On Jun 13 13:13, Michelle Sullivan wrote: >>> Don Lewis wrote: On 13 Jun, Michelle Sullivan wrote: > SSH would be the biggie that most security departments are scared > of... > Well, ssh is available in

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Miroslav Lachman
Michelle Sullivan wrote on 06/13/2015 14:48: PS: There is a workaround for ssh clients in /etc/ssh/ssh_config to stop it falling back to "insecure" protocols - though every freebsd-update attempts to change this file back to the default... fortunately I have puppet to reset the file in the event

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Miroslav Lachman
Michelle Sullivan wrote on 06/13/2015 14:29: [...] 57 servers around the world that I have to maintain, patch and upgrade at the same time as devel and maintain my applications... yeah I don't do source stuff ;-) It would be useful to have that option in freebsd-update. I was using freebsd-u

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Don Lewis wrote: > > Something to consider is building your own customized releases and > setting up your own freebsd-update server. It's an additional headache, > but would allow you to eliminate some possible additional hazards, such > as the setuid rsh and rlogin. I'm thinking about doing it h

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Miroslav Lachman wrote: > Michelle Sullivan wrote on 06/13/2015 14:29: > > [...] > >> 57 servers around the world that I have to maintain, patch and upgrade >> at the same time as devel and maintain my applications... yeah I don't >> do source stuff ;-) >> >> It would be useful to have that option

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Eitan Adler
On 13 June 2015 at 15:48, Michelle Sullivan wrote: > I'd love to setup my own freebsd-update server - if only there were docs > about how to do it... I'd have done it a couple of months ago, Google > didn't reveal anything to me when I looked though... https://www.freebsd.org/doc/en_US.ISO8859-1

Re: OpenSSL Security Advisory [11 Jun 2015]

2015-06-13 Thread Michelle Sullivan
Eitan Adler wrote: > On 13 June 2015 at 15:48, Michelle Sullivan wrote: > > >> I'd love to setup my own freebsd-update server - if only there were docs >> about how to do it... I'd have done it a couple of months ago, Google >> didn't reveal anything to me when I looked though... >> > > ht