There was discussion here a few months ago about there being no official date for end of life on Lenny. This has changed. I just noticed this item on the security announcement mailing list: http://lists.debian.org/debian-security-announce/2011/msg00238.html No new Lenny updates after 6 February 2012.