On Thu, Nov 28, 2002 at 12:08:29PM -0500, David Ellis wrote: > 4 months ago I switched to Redhat 7.2 - patched weekly with the Redhat > network. This infrastructure was hacked repeatedly, my email server was an > open relay, my ftp server was being brought down every other day, my web > server had the apache service brought down repeatedly, I was rebuilding my > boxes every three days. In short it was HELL. 'Brought down'? You mean there was a DOS exploit in your FTP server and HTTP server? Surely something that obvious was quickly patched. An open relay is a configuration problem, not a software issue. If RedHat is shipping a mail server that is an open relay by default, then they're morons and should be LART'd repeatedly with extreme prejudice. > I switched to Debian Woody about three weeks ago, installing the bsd based > ftp server (not that leaky wu-ftpd), the latest apache, exim, and cyrus. So > far so good - no hacks, reject log shows the bounced relay requests, and the > web service has been solid (although a browse through the logs shows the > buffer and cgi attacks being tried). You'll find apache's logs will quickly fill with lame IIS attacks. It's tiresome, but as long as people use IIS (and not even patch it against the _known_ holes), you'll have to deal it. Do you have security.debian.org in your sources.list and have you subscribed to debian-security? That makes it trivial to keep up to date with security patches if/when they happen. > In short the article is almost right: > - Older Linux Distributions ARE vulnerable, the patches to fix > vulnerabilities on the older releases almost never work right (IMO), and > this is a problem. Debian is fanatical about working security fixes. Fixes are _back-ported_ to the stable branch and tested heavily, so you should have no issues. > - Older Windows Releases ARE vulnerable, but the patches to fix the > vulnerabilities DO work. Anecdotal, of course, but I keep hearing the exact opposite from people who are forced to maintain MS machines. Also, how many reboots do they require? -rob
Attachment:
pgpE7meC1srw2.pgp
Description: PGP signature