Text 1822, 104 rader
Skriven 2004-12-21 09:17:00 av Chip Hearn (1:3613/52)
   Kommentar till text 1811 av MARTIN ATKINS (1:123/140)
Ärende: Re: Mandrake 10.1
=========================
-=> MARTIN ATKINS Scribbled to CHIP HEARN <=-

 -=> CHIP HEARN wrote to MARTIN ATKINS <=-

 CH>   Re: Mandrake 10.1
 CH>   By: MARTIN ATKINS to BEN RITCHEY on Fri Dec 17 2004 10:07 am

 > Prior to my present setup i had Mandrake 9.0, far more stable than 10.0.
 > I've found with these RPM setups that upgrading can cause a lot of problems
 > so i always go for a complete install but for some i imagine this would be a
 > lot of aggravation. Just to satisfy my curiosity can i ask what applications
 > you found incompatible with Mandrake 9.2?

 CH> Dude, I would highly suggest you not do full installs.  An incident I
 CH> encountered shows what a mistake that is.

 MA> Sorry. What i should have said is i do a fresh install. I'm glad you
 MA> pointed it out because i always recommend the minimal installation
 MA> to start off with and the build machine as required. As you point out
 MA> bellow this allows security matters to be addressed as you go along.
 MA> Also it is better for identifying any installation problems with
 MA> individual packages.

Even in Windows a full install is not always advantagous.  :)  Thats why
I prefer Debian over any of the other Distro's.  I just find it much
easier to deal with.

 CH> I had hired a RH certified individual.  I had a job come up where the
 CH> client wanted a Linux server to run a program called Medical Manager.
 CH> Anyway, this so called RH Certified person was put on the task of
 CH> building the machine.

 MA> I can see trouble looming already. ;)

I'll never fall for that one again.  :)

 CH> It was stressed that it didn't need everything,
 CH> as the server was going to have dumb terminals connected via serial.
 CH> Anyway, things went on, the system was built, and installed.  A couple
 CH> of months later, I get a frantic call from the client. They can't
 CH> connect to their server.  The employee that set it up was at another
 CH> client, so I went to see what was going on.  Now, understand, I'm not
 CH> RH Certified, just a long time Linux user myself.  Anyway, I found that
 CH> the box had been rooted.  Eventually, after a bunch of checking, and
 CH> work, I was able to get enough info to figure out what had occured.
 CH> Some Warez group had hacked into the machine, in the easiest way
 CH> possible.  Turns out that my Employee, when he had built the RH box,
 CH> had done a full install.  There was some stupid web interface thing
 CH> that having not be configured, was still using the default username and
 CH> password.  This web interface thing was a remote administrator access
 CH> port.  Its installed when you do a full install.  Oh, instead of
 CH> another one of my normal setups, the Employee had also changed the
 CH> router, instead of opening the specific ports I specified, he had
 CH> basically setup the server in a DMZ.  But the main portion, no one had
 CH> gone through all the Installed programs and made sure they were either
 CH> not running or diabled access, or changed the passwords.

 MA> This could be the culprit:-

 MA> Summary: An SSL web-based administration interface for Unix systems.

 MA> Description: A web-based administration interface for Unix systems.
 MA> Using Webmin you can configure DNS, Samba, NFS, local/remote
 MA> filesystems, Apache, Sendmail/Postfix, and more using your web browser.

 MA> After installation, enter the URL https://localhost:10000/ into your
 MA> browser and login as root with your root password. Please consider
 MA> logging in and modify your password for security issue.

 MA> PLEASE NOTE THAT THIS VERSION NOW USES SECURE WEB TRANSACTIONS: YOU
 MA> HAVE TO LOGIN TO "https://localhost:10000/" AND NOT
 MA> "http://localhost:10000/".

Actually, no, Webmin I'm very familiar with and use it all the time.
This was some RH thing... I don't remember all the details, as that was
a few years back.  I avoid Red Hat like the plague, I've never liked it
even back in the earlier days.

 CH> Anyway, I'd be very careful about your system.  You have no idea what
 CH> all was installed.  Very dangerous.

 MA> Fortunately i only run a small home network. All remote machines are
 MA> isolated before i use the internet so if my main server came under
 MA> attack it would only be something that would spur my interest in better
 MA> security.

Thats a good thing...  I have numerous Co-Located machines that one or
more ports open, just depends on the use.  I've been attacked numerous
time, but, that's just the nature of the business.  :)



Sniper
Killed In Action BBS, telnet://kia.zapto.org
Home of the Unofficial SynchroNet Support Network.
download the info pack at any of the below sites:
http://www.chcomputer.net/USSNET.ZIP
http://www.ussnet.org
telnet://kia.zapto.org

... Warning: It is not for the squeamish or the humor impaired.
--- MultiMail/Linux v0.45
--- SBBSecho 2.00-Win32
 * Origin: Killed in Action BBS  telnet://kia.zapto.org (1:3613/52)